Merge branch 'main' into feature/android-sub-module-loading

* Use local timestamp for Files module timeline.

Most other Android timestamps appear to be local time. The
results timeline is more useful if all the timestamps
are consistent. I would prefer to use UTC, but that would
mean converting all the other timestamps to UTC as well. We probably
do not have sufficient information to do that accurately,
especially if the device is moving between timezones..

* Add file timestamp modules to add logs into timeline

* Handle case were we cannot load device timezone

* Fix crash if prop file does not exist

* Move _get_file_modification_time to BugReportModule

* Add backport for timezone and fix Tombstone module to use local time.

* Fix import for backported Zoneinfo

* Fix ruff error

.github/workflows/add-issue-to-project.yml

@@ -0,0 +1,19 @@
+name: Add issue to project
+
+on:
+  issues:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  add-to-project:
+    name: Add issue to project
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@v0.5.0
+        with:
+          # You can target a project in a different organization
+          # to the issue
+          project-url: https://github.com/orgs/mvt-project/projects/1
+          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/mypy.yml

@@ -0,0 +1,23 @@
+name: Mypy
+on: workflow_dispatch
+
+jobs:
+  mypy_py3:
+    name: Mypy check
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.9
+          cache: 'pip'
+      - name: Checkout
+        uses: actions/checkout@master
+      - name: Install Dependencies
+        run: |
+          pip install mypy
+      - name: mypy
+        run: |
+          make mypy

.github/workflows/publish-release-docker.yml

@@ -0,0 +1,61 @@
+#
+name: Create and publish a Docker image
+
+# Configures this workflow to run every time a release is published.
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      #
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
+      - name: Log in to the Container registry
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
+      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
+      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)."
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+

.github/workflows/python-package.yml

@@ -1,43 +0,0 @@
-# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
-
-name: Python package
-
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        # python-version: [3.7, 3.8, 3.9]
-        python-version: [3.8, 3.9]
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install flake8 pytest safety stix2
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-        python -m pip install .
-    - name: Lint with flake8
-      run: |
-        # stop the build if there are Python syntax errors or undefined names
-        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-    - name: Safety checks
-      run: safety check
-    - name: Test with pytest
-      run: pytest

.github/workflows/ruff.yml

@@ -0,0 +1,27 @@
+name: Ruff
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  ruff_py3:
+    name: Ruff syntax check
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.9
+          cache: 'pip'
+      - name: Checkout
+        uses: actions/checkout@master
+      - name: Install Dependencies
+        run: |
+          pip install ruff
+      - name: ruff
+        run: |
+          make ruff

.github/workflows/scripts/update-ios-releases.py

@@ -0,0 +1,96 @@
+"""
+Python script to download the Apple RSS feed and parse it.
+"""
+
+import json
+import os
+import urllib.request
+from xml.dom.minidom import parseString
+
+from packaging import version
+
+
+def download_apple_rss(feed_url):
+    with urllib.request.urlopen(feed_url) as f:
+        rss_feed = f.read().decode("utf-8")
+    print("Downloaded RSS feed from Apple.")
+    return rss_feed
+
+
+def parse_latest_ios_versions(rss_feed_text):
+    latest_ios_versions = []
+
+    parsed_feed = parseString(rss_feed_text)
+    for item in parsed_feed.getElementsByTagName("item"):
+        title = item.getElementsByTagName("title")[0].firstChild.data
+        if not title.startswith("iOS"):
+            continue
+
+        import re
+
+        build_match = re.match(
+            r"iOS (?P<version>[\d\.]+) (?P<beta>beta )?(\S*)?\((?P<build>.*)\)", title
+        )
+        if not build_match:
+            print("Could not parse iOS build:", title)
+            continue
+
+        # Handle iOS beta releases
+        release_info = build_match.groupdict()
+        release_beta = release_info.pop("beta")
+        if release_beta:
+            print("Skipping beta release:", title)
+            continue
+
+        # Some iOS releases have multiple build number for different hardware models.
+        # We will split these into separate entries and record each build number.
+        build_list = release_info.pop("build")
+        build_variants = build_list.split(" | ")
+        for build_number in build_variants:
+            release_info["build"] = build_number
+            latest_ios_versions.append(release_info)
+
+    return latest_ios_versions
+
+
+def update_mvt(mvt_checkout_path, latest_ios_versions):
+    version_path = os.path.join(mvt_checkout_path, "src/mvt/ios/data/ios_versions.json")
+    with open(version_path, "r") as version_file:
+        current_versions = json.load(version_file)
+
+    new_entry_count = 0
+    for new_version in latest_ios_versions:
+        for current_version in current_versions:
+            if new_version["build"] == current_version["build"]:
+                break
+        else:
+            # New version that does not exist in current data
+            current_versions.append(new_version)
+            new_entry_count += 1
+
+    if not new_entry_count:
+        print("No new iOS versions found.")
+    else:
+        print("Found {} new iOS versions.".format(new_entry_count))
+        new_version_list = sorted(
+            current_versions, key=lambda x: version.Version(x["version"])
+        )
+        with open(version_path, "w") as version_file:
+            json.dump(new_version_list, version_file, indent=4)
+
+
+def main():
+    print("Downloading RSS feed...")
+    mvt_checkout_path = os.path.abspath(
+        os.path.join(os.path.dirname(__file__), "../../../")
+    )
+
+    rss_feed = download_apple_rss(
+        "https://developer.apple.com/news/releases/rss/releases.rss"
+    )
+    latest_ios_version = parse_latest_ios_versions(rss_feed)
+    update_mvt(mvt_checkout_path, latest_ios_version)
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/tests.yml

@@ -0,0 +1,38 @@
+name: Tests
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build:
+    name: Run Python Tests
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.8', '3.9', '3.10']  # , '3.11']
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install Python dependencies
+        run: |
+          make install
+          make test-requirements
+      - name: Test with pytest
+        run: |
+          set -o pipefail
+          make test-ci | tee pytest-coverage.txt
+
+      - name: Pytest coverage comment
+        continue-on-error: true # Workflows running on a fork can't post comments
+        uses: MishaKav/pytest-coverage-comment@main
+        if: github.event_name == 'pull_request'
+        with:
+          pytest-coverage-path: ./pytest-coverage.txt
+          junitxml-path: ./pytest.xml

.github/workflows/update-ios-data.yml

@@ -0,0 +1,29 @@
+name: Update iOS releases and version numbers
+run-name: ${{ github.actor }} is finding the latest iOS release version and build numbers
+on:
+  workflow_dispatch:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    - cron:  '0 */6 * * *'
+
+
+jobs:
+  update-ios-version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+      - name: Run script to fetch latest iOS releases from Apple RSS feed.
+        run: python3 .github/workflows/scripts/update-ios-releases.py
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v5
+        with:
+          title: '[auto] Update iOS releases and versions'
+          commit-message: Add new iOS versions and build numbers
+          branch: auto/add-new-ios-releases
+          body: |
+            This is an automated pull request to update the iOS releases and version numbers.
+          add-paths: |
+            *.json
+          labels: |
+            automated pr

.gitignore

@@ -50,6 +50,8 @@ coverage.xml
 *.py,cover
 .hypothesis/
 .pytest_cache/
+pytest-coverage.txt
+pytest.xml
 
 # Translations
 *.mo
@@ -131,3 +133,9 @@ dmypy.json
 
 # Temporal files
 *~
+
+# IDEA Dev Environment
+.idea
+
+# Sublime Text project files
+*.sublime*

.readthedocs.yaml

@@ -5,11 +5,15 @@
 # Required
 version: 2
 
+build:
+  os: "ubuntu-22.04"
+  tools:
+    python: "3.11"
+
 mkdocs:
   configuration: mkdocs.yml
 
 # Optionally set the version of Python and requirements required to build your docs
 python:
-   version: 3.7
    install:
    - requirements: docs/requirements.txt

.safety-policy.yml

@@ -0,0 +1,11 @@
+# Safety Security and License Configuration file
+# We recommend checking this file into your source control in the root of your Python project
+# If this file is named .safety-policy.yml and is in the same directory where you run `safety check` it will be used by default.
+# Otherwise, you can use the flag `safety check --policy-file <path-to-this-file>` to specify a custom location and name for the file.
+# To validate and review your policy file, run the validate command: `safety validate policy_file --path <path-to-this-file>`
+security: # configuration for the `safety check` command
+    ignore-vulnerabilities: # Here you can list multiple specific vulnerabilities you want to ignore (optionally for a time period)
+        67599: # Example vulnerability ID
+            reason: disputed, inapplicable
+        70612:
+            reason: disputed, inapplicable

AUTHORS

@@ -1,7 +0,0 @@
-MVT was originally authored by Claudio Guarnieri <nex@nex.sx>.
-
-For an up-to-date list of all contributors visit:
-    https://github.com/mvt-project/mvt/graphs/contributors
-
-Or run:
-    git shortlog -s -n

CONTRIBUTING.md

@@ -0,0 +1,65 @@
+# Contributing to Mobile Verification Toolkit (MVT)
+
+We greatly appreciate contributions to MVT!
+
+Your involvement, whether through identifying issues, improving functionality, or enhancing documentation, is very much appreciated. To ensure smooth collaboration and a welcoming environment, we've outlined some key guidelines for contributing below.
+
+## Getting started
+
+Contributing to an open-source project like MVT might seem overwhelming at first, but we're here to support you!
+
+ Whether you're a technologist, a frontline human rights defender, a field researcher, or someone new to consensual spyware forensics, there are many ways to make meaningful contributions.
+
+ Here's how you can get started:
+
+1. **Explore the codebase:**
+    - Browse the repository to get familar with MVT. Many MVT modules are simple in functionality and easy to understand.
+    - Look for `TODO:` or `FIXME:` comments in the code for areas that need attention.
+
+2. **Check Github issues:**
+    - Look for issues tagged with ["help wanted"](https://github.com/mvt-project/mvt/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22) or ["good first issue"](https://github.com/mvt-project/mvt/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) to find tasks that are beginner-friendly or where input from the community would be helpful.
+
+3. **Ask for guidance:**
+
+    - If you're unsure where to start, feel free to open a [discussion](https://github.com/mvt-project/mvt/discussions) or comment on an issue.
+
+## How to contribute:
+
+1. **Report issues:**
+
+ - Found a bug? Please check existing issues to see if it's already reported. If not, open a new issue. Mobile operating systems and databases are constantly evolving, an new errors may appear spontaniously in new app versions.
+
+ **Please provide as much information as possible about the prodblem including: any error messages, steps to reproduce the problem, and any logs or screenshots that can help.**
+
+
+2. **Suggest features:**
+    - If you have an idea for new functionality, create a feature request issue and describe your proposal.
+
+3. **Submit code:**
+    - Fork the repository and create a new branch for your changes.
+    - Ensure your changes align with the code style guidelines (see below).
+    - Open a pull request (PR) with a clear description of your changes and link it to any relevant issues.
+
+4. **Documentation contributions:**
+    - Improving documentation is just as valuable as contributing code! If you notice gaps or inaccuracies in the documentation, feel free to submit changes or suggest updates.
+
+## Code style
+Please follow these code style guidelines for consistency and readability:
+
+- **Indentation**: use 4 spaces per tab.
+- **Quotes**: Use double quotes (`"`) by default. Use single quotes (`'`) for nested strings instead of escaping (`\"`), or when using f-formatting.
+- **Maximum line length**:
+    - Aim for lines no longer than 80 characters.
+    - Exceptions are allowed for long log lines or strings, which may extend up to 100 characters.
+    - Wrap lines that exceed 100 characters.
+
+Follow [PEP 8 guidelines](https://peps.python.org/pep-0008/) for indentation and overall Python code style. All MVT code is automatically linted with [Ruff](https://github.com/astral-sh/ruff) before merging.
+
+Please check your code before opening a pull request by running `make ruff`
+
+
+## Community and support
+
+We aim to create a supportive and collaborative environment for all contributors. If you run into any challenges, feel free to reach out through the discussions or issues section of the repository.
+
+Your contributions, big or small, help improve MVT and are always appreciated.

Dockerfile

@@ -1,89 +1,159 @@
-FROM ubuntu:20.04
+# Base image for building libraries
+# ---------------------------------
+FROM ubuntu:22.04 as build-base
 
-# Ref. https://github.com/mvt-project/mvt
+ARG DEBIAN_FRONTEND=noninteractive
 
-LABEL url="https://mvt.re"
-LABEL vcs-url="https://github.com/mvt-project/mvt"
-LABEL description="MVT is a forensic tool to look for signs of infection in smartphone devices."
-
-ENV PIP_NO_CACHE_DIR=1
-
-# Fixing major OS dependencies
-# ----------------------------
-RUN apt update \
-  && apt install -y python3 python3-pip libusb-1.0-0-dev \
-  && apt install -y wget unzip\ 
-  && DEBIAN_FRONTEND=noninteractive apt-get -y install default-jre-headless \
-
-# Install build tools for libimobiledevice
-# ----------------------------------------
+# Install build tools and dependencies
+RUN apt-get update \
+  && apt-get install -y \
   build-essential \
-  checkinstall \
   git \
   autoconf \
   automake \
   libtool-bin \
-  libplist-dev \
-  libusbmuxd-dev \
-  libssl-dev \
-  sqlite3 \
   pkg-config \
+  libcurl4-openssl-dev \
+  libusb-1.0-0-dev \
+  libssl-dev \
+  udev \
+  && rm -rf /var/lib/apt/lists/*
 
-# Clean up
+
+# libplist
 # --------
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/* /var/cache/apt
+FROM build-base as build-libplist
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libplist
 
 
-# Build libimobiledevice
-# ----------------------
-RUN git clone https://github.com/libimobiledevice/libplist \
-  && git clone https://github.com/libimobiledevice/libimobiledevice-glue \
-  && git clone https://github.com/libimobiledevice/libusbmuxd \
-  && git clone https://github.com/libimobiledevice/libimobiledevice \
-  && git clone https://github.com/libimobiledevice/usbmuxd \
+# libimobiledevice-glue
+# ---------------------
+FROM build-base as build-libimobiledevice-glue
 
-  && cd libplist && ./autogen.sh && make && make install && ldconfig \
+# Install dependencies
+COPY --from=build-libplist /build /
 
-  && cd ../libimobiledevice-glue && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --prefix=/usr && make && make install && ldconfig \
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd libimobiledevice-glue \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice-glue
 
-  && cd ../libusbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh && make && make install && ldconfig \
 
-  && cd ../libimobiledevice && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --enable-debug && make && make install && ldconfig \
+# libtatsu
+# --------
+FROM build-base as build-libtatsu
 
-  && cd ../usbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make && make install \
+# Install dependencies
+COPY --from=build-libplist /build /
 
-  # Clean up.
-  && cd .. && rm -rf libplist libimobiledevice-glue libusbmuxd libimobiledevice usbmuxd
+# Build
+RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libtatsu
 
-# Installing MVT
-# --------------
-RUN pip3 install mvt
+
+# libusbmuxd
+# ----------
+FROM build-base as build-libusbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libusbmuxd
+
+
+# libimobiledevice
+# ----------------
+FROM build-base as build-libimobiledevice
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimobiledevice \
+  && ./autogen.sh --enable-debug && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice
+
+
+# usbmuxd
+# -------
+FROM build-base as build-usbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
+  && ./autogen.sh --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf usbmuxd && mv /build/lib /build/usr/lib
+
+
+# Create main image
+FROM ubuntu:22.04 as main
+
+LABEL org.opencontainers.image.url="https://mvt.re"
+LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
+LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
+LABEL org.opencontainers.image.title="Mobile Verification Toolkit"
+LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
+LABEL org.opencontainers.image.licenses="MVT License 1.1"
+LABEL org.opencontainers.image.base.name=docker.io/library/ubuntu:22.04
+
+# Install runtime dependencies
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update \
+  && apt-get install -y \
+  adb \
+  default-jre-headless \
+  libcurl4 \
+  libssl3 \
+  libusb-1.0-0 \
+  python3 \
+  sqlite3
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+COPY --from=build-usbmuxd /build /
+
+# Install mvt using the locally checked out source
+COPY . mvt/
+RUN apt-get update \
+   && apt-get install -y git python3-pip \
+   && PIP_NO_CACHE_DIR=1 pip3 install --upgrade pip \
+   && PIP_NO_CACHE_DIR=1 pip3 install ./mvt \
+   && apt-get remove -y python3-pip git && apt-get autoremove -y \
+   && rm -rf /var/lib/apt/lists/* \
+   && rm -rf mvt
 
 # Installing ABE
-# --------------
-RUN mkdir /opt/abe \
-  && wget https://github.com/nelenkov/android-backup-extractor/releases/download/20210709062403-4c55371/abe.jar -O /opt/abe/abe.jar \
+ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2e11632 \
+  https://github.com/nelenkov/android-backup-extractor/releases/download/master-20221109063121-8fdfc5e/abe.jar /opt/abe/abe.jar
 # Create alias for abe
-  && echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
+RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
 
-# Install Android Platform Tools 
-# ------------------------------ 
-
-RUN mkdir /opt/android \
-  && wget -q https://dl.google.com/android/repository/platform-tools-latest-linux.zip \
-  && unzip platform-tools-latest-linux.zip -d /opt/android \
-# Create alias for adb 
-  && echo 'alias adb="/opt/android/platform-tools/adb"' >> ~/.bashrc 
-
-# Generate adb key folder 
-# ------------------------------ 
-RUN mkdir /root/.android && /opt/android/platform-tools/adb keygen /root/.android/adbkey
+# Generate adb key folder
+RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey 2&>1 > /dev/null; fi' >> ~/.bashrc
+RUN mkdir /root/.android
 
 # Setup investigations environment
-# --------------------------------
 RUN mkdir /home/cases
-WORKDIR /home/cases 
+WORKDIR /home/cases
 RUN echo 'echo "Mobile Verification Toolkit @ Docker\n------------------------------------\n\nYou can find information about how to use this image for Android (https://github.com/mvt-project/mvt/tree/master/docs/android) and iOS (https://github.com/mvt-project/mvt/tree/master/docs/ios) in the official docs of the project.\n"' >> ~/.bashrc \
   && echo 'echo "Note that to perform the debug via USB you might need to give the Docker image access to the USB using \"docker run -it --privileged -v /dev/bus/usb:/dev/bus/usb mvt\" or, preferably, the \"--device=\" parameter.\n"' >> ~/.bashrc
 

Dockerfile.android

@@ -0,0 +1,36 @@
+# Create main image
+FROM python:3.10.14-alpine3.20 as main
+
+LABEL org.opencontainers.image.url="https://mvt.re"
+LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
+LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
+LABEL org.opencontainers.image.title="Mobile Verification Toolkit (Android)"
+LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
+LABEL org.opencontainers.image.licenses="MVT License 1.1"
+LABEL org.opencontainers.image.base.name=docker.io/library/python:3.10.14-alpine3.20
+
+# Install runtime dependencies
+RUN apk add --no-cache \
+  android-tools \
+  git \
+  libusb \
+  openjdk11-jre-headless \
+  sqlite
+
+# Install mvt
+COPY ./ mvt
+RUN apk add --no-cache --virtual .build-deps gcc musl-dev \
+  && PIP_NO_CACHE_DIR=1 pip3 install ./mvt \
+  && apk del .build-deps gcc musl-dev && rm -rf ./mvt
+
+# Installing ABE
+ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2e11632 \
+  https://github.com/nelenkov/android-backup-extractor/releases/download/master-20221109063121-8fdfc5e/abe.jar /opt/abe/abe.jar
+# Create alias for abe
+RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
+
+# Generate adb key folder
+RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey 2&>1 > /dev/null; fi' >> ~/.bashrc
+RUN mkdir /root/.android
+
+ENTRYPOINT [ "/usr/local/bin/mvt-android" ]

Dockerfile.ios

@@ -0,0 +1,137 @@
+# Base image for building libraries
+# ---------------------------------
+FROM ubuntu:22.04 as build-base
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+# Install build tools and dependencies
+RUN apt-get update \
+  && apt-get install -y \
+  build-essential \
+  git \
+  autoconf \
+  automake \
+  libtool-bin \
+  pkg-config \
+  libcurl4-openssl-dev \
+  libusb-1.0-0-dev \
+  libssl-dev \
+  udev \
+  && rm -rf /var/lib/apt/lists/*
+
+
+# libplist
+# --------
+FROM build-base as build-libplist
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libplist
+
+
+# libimobiledevice-glue
+# ---------------------
+FROM build-base as build-libimobiledevice-glue
+
+# Install dependencies
+COPY --from=build-libplist /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd libimobiledevice-glue \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice-glue
+
+
+# libtatsu
+# --------
+FROM build-base as build-libtatsu
+
+# Install dependencies
+COPY --from=build-libplist /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libtatsu
+
+
+# libusbmuxd
+# ----------
+FROM build-base as build-libusbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libusbmuxd
+
+
+# libimobiledevice
+# ----------------
+FROM build-base as build-libimobiledevice
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimobiledevice \
+  && ./autogen.sh --enable-debug && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice
+
+
+# usbmuxd
+# -------
+FROM build-base as build-usbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
+  && ./autogen.sh --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf usbmuxd && mv /build/lib /build/usr/lib
+
+
+# Main image
+# ----------
+FROM python:3.10.14-alpine3.20 as main
+
+LABEL org.opencontainers.image.url="https://mvt.re"
+LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
+LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
+LABEL org.opencontainers.image.title="Mobile Verification Toolkit (iOS)"
+LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
+LABEL org.opencontainers.image.licenses="MVT License 1.1"
+LABEL org.opencontainers.image.base.name=docker.io/library/python:3.10.14-alpine3.20
+
+# Install runtime dependencies
+RUN apk add --no-cache \
+  gcompat \
+  libcurl \
+  libssl3 \
+  libusb \
+  sqlite
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+COPY --from=build-usbmuxd /build /
+
+# Install mvt using the locally checked out source
+COPY ./ mvt
+RUN apk add --no-cache --virtual .build-deps git gcc musl-dev \
+  && PIP_NO_CACHE_DIR=1 pip3 install ./mvt \
+  && apk del .build-deps git gcc musl-dev && rm -rf ./mvt
+
+ENTRYPOINT [ "/usr/local/bin/mvt-ios" ]

Makefile

@@ -1,10 +1,44 @@
 PWD = $(shell pwd)
 
+autofix:
+	ruff format .
+	ruff check --fix .
+
+check: ruff mypy
+
+ruff:
+	ruff format --check .
+	ruff check -q .
+
+mypy:
+	mypy
+
+test:
+	python3 -m pytest
+
+test-ci:
+	python3 -m pytest -v
+
+install:
+	python3 -m pip install --upgrade -e .
+
+test-requirements:
+	python3 -m pip install --upgrade -r test-requirements.txt
+
+generate-proto-parsers:
+	# Generate python parsers for protobuf files
+	PROTO_FILES=$$(find src/mvt/android/parsers/proto/ -iname "*.proto"); \
+	protoc -Isrc/mvt/android/parsers/proto/ --python_betterproto_out=src/mvt/android/parsers/proto/ $$PROTO_FILES
+
 clean:
-	rm -rf $(PWD)/build $(PWD)/dist $(PWD)/mvt.egg-info
+	rm -rf $(PWD)/build $(PWD)/dist $(PWD)/src/mvt.egg-info
 
 dist:
-	python3 setup.py sdist bdist_wheel
+	python3 -m pip install --upgrade build
+	python3 -m build
 
 upload:
 	python3 -m twine upload dist/*
+
+test-upload:
+	python3 -m twine upload --repository testpypi dist/*

README.md

@@ -1,34 +1,51 @@
 <p align="center">
-     <img src="./docs/mvt.png" width="200" />
+     <img src="https://docs.mvt.re/en/latest/mvt.png" width="200" />
 </p>
 
 # Mobile Verification Toolkit
 
 [![](https://img.shields.io/pypi/v/mvt)](https://pypi.org/project/mvt/)
 [![Documentation Status](https://readthedocs.org/projects/mvt/badge/?version=latest)](https://docs.mvt.re/en/latest/?badge=latest)
+[![CI](https://github.com/mvt-project/mvt/actions/workflows/tests.yml/badge.svg)](https://github.com/mvt-project/mvt/actions/workflows/tests.yml)
+[![Downloads](https://pepy.tech/badge/mvt)](https://pepy.tech/project/mvt)
 
 Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices.
 
-It has been developed and released by the [Amnesty International Security Lab](https://www.amnesty.org/en/tech/) in July 2021 in the context of the [Pegasus project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology and forensic evidence](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/).
+It has been developed and released by the [Amnesty International Security Lab](https://securitylab.amnesty.org) in July 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/). It continues to be maintained by Amnesty International and other contributors.
 
-*Warning*: MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance.
+> **Note**
+> MVT is a forensic research tool intended for technologists and investigators. It requires understanding digital forensics and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek reputable expert assistance.
+>
+
+### Indicators of Compromise
+
+MVT supports using public [indicators of compromise (IOCs)](https://github.com/mvt-project/mvt-indicators) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by [Amnesty International](https://github.com/AmnestyTech/investigations/) and other  research groups.
+
+> **Warning**
+> Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.
+>
+> Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
+>
+>Such support is available to civil society through [Amnesty International's Security Lab](https://securitylab.amnesty.org/get-help/?c=mvt_docs) or through our forensic partnership with [Access Now’s Digital Security Helpline](https://www.accessnow.org/help/).
+
+More information about using indicators of compromise with MVT is available in the [documentation](https://docs.mvt.re/en/latest/iocs/).
 
 ## Installation
 
-MVT can be installed from sources or from [PyPi](https://pypi.org/project/mvt/) (you will need some dependencies, check the [documentation](https://docs.mvt.re/en/latest/install/)):
+MVT can be installed from sources or from [PyPI](https://pypi.org/project/mvt/) (you will need some dependencies, check the [documentation](https://docs.mvt.re/en/latest/install/)):
 
 ```
 pip3 install mvt
 ```
 
-Alternatively, you can decide to run MVT and all relevant tools through a [Docker container](https://docs.mvt.re/en/latest/docker/).
+For alternative installation options and known issues, please refer to the [documentation](https://docs.mvt.re/en/latest/install/) as well as [GitHub Issues](https://github.com/mvt-project/mvt/issues).
 
-**Please note:** MVT is best run on Linux or Mac systems. [It does not currently support running natively on Windows.](https://docs.mvt.re/en/latest/install/#mvt-on-windows)
 
 ## Usage
 
 MVT provides two commands `mvt-ios` and `mvt-android`. [Check out the documentation to learn how to use them!](https://docs.mvt.re/)
 
+
 ## License
 
 The purpose of MVT is to facilitate the ***consensual forensic analysis*** of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want MVT to enable privacy violations of non-consenting individuals.  In order to achieve this, MVT is released under its own license. [Read more here.](https://docs.mvt.re/en/latest/license/)

SECURITY.md

@@ -0,0 +1,5 @@
+# Reporting security issues
+
+Thank you for your interest in reporting security issues and vulnerabilities! Security research is of utmost importance and we take all reports seriously. If you discover an issue please report it to us right away!
+
+Please DO NOT file a public issue, instead send your report privately to *nex [at] nex [dot] sx*. You can also write PGP-encrypted emails to [this key](https://keybase.io/nex/pgp_keys.asc?fingerprint=05216f3b86848a303c2fe37dd166f1667359d880).

dev/mvt-android

@@ -1,14 +0,0 @@
-#!/usr/bin/env python3
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-
-from mvt import android
-
-android.cli()

dev/mvt-ios

@@ -1,14 +0,0 @@
-#!/usr/bin/env python3
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-
-from mvt import ios
-
-ios.cli()

docs/android/backup.md

@@ -11,18 +11,41 @@ That said, most versions of Android should still allow to locally backup SMS mes
 Because `mvt-android check-backup` currently only supports checking SMS messages, you can indicate to backup only those:
 
 ```bash
-adb backup com.android.providers.telephony
+adb backup -nocompress com.android.providers.telephony
 ```
 
 In case you nonetheless wish to take a full backup, you can do so with
 
 ```bash
-adb backup -all
+adb backup -nocompress -all
 ```
 
-## Unpack the backup
+Some recent phones will enforce the utilisation of a password to encrypt the backup archive. In that case, the password will obviously be needed to extract and analyse the data later on.
 
-In order to unpack the backup, use [Android Backup Extractor (ABE)](https://github.com/nelenkov/android-backup-extractor) to convert it to a readable file format. Make sure that java is installed on your system and use the following command:
+## Unpack and check the backup
+
+MVT includes a partial implementation of the Android Backup parsing, because of the implementation difference in the compression algorithm between Java and Python. The `-nocompress` option passed to adb in the section above allows to avoid this issue. You can analyse and extract SMSs from the backup directly with MVT:
+
+```bash
+$ mvt-android check-backup --output /path/to/results/ /path/to/backup.ab
+14:09:45 INFO     [mvt.android.cli] Checking ADB backup located at: backup.ab
+         INFO     [mvt.android.modules.backup.sms] Running module SMS...
+         INFO     [mvt.android.modules.backup.sms] Processing SMS backup file at
+                  apps/com.android.providers.telephony/d_f/000000_sms_backup
+         INFO     [mvt.android.modules.backup.sms] Extracted a total of 64 SMS messages
+```
+
+If the backup is encrypted, MVT will prompt you to enter the password. A backup password can also be provided with the `--backup-password` command line option or through the `MVT_ANDROID_BACKUP_PASSWORD` environment variable. The same options can also be used to when analysing an encrypted backup collected through AndroidQF in the `mvt-android check-androidqf` command:
+
+```bash
+$ mvt-android check-backup --backup-password "password123" --output /path/to/results/ /path/to/backup.ab
+```
+
+Through the `--iocs` argument you can specify a [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro) file defining a list of malicious indicators to check against the records extracted from the backup by MVT. Any matches will be highlighted in the terminal output.
+
+## Alternative ways to unpack and check the backup
+
+If you encounter an issue during the analysis of the backup, you can alternatively use [Android Backup Extractor (ABE)](https://github.com/nelenkov/android-backup-extractor) to convert it to a readable file format. Make sure that java is installed on your system and use the following command:
 
 ```bash
 java -jar ~/path/to/abe.jar unpack backup.ab backup.tar
@@ -33,17 +56,4 @@ If the backup is encrypted, ABE will prompt you to enter the password.
 
 Alternatively, [ab-decrypt](https://github.com/joernheissler/ab-decrypt) can be used for that purpose.
 
-## Check the backup
-
-You can then extract SMSs containing links with MVT:
-
-```bash
-$ mvt-android check-backup --output /path/to/results/ /path/to/backup/
-16:18:38 INFO     [mvt.android.cli] Checking ADB backup located at: .
-         INFO     [mvt.android.modules.backup.sms] Running module SMS...
-         INFO     [mvt.android.modules.backup.sms] Processing SMS backup file at /path/to/backup/apps/com.android.providers.telephony/d_f/000000_sms_backup
-16:18:39 INFO     [mvt.android.modules.backup.sms] Extracted a total of
-                  64 SMS messages containing links
-```
-
-Through the `--iocs` argument you can specify a [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro) file defining a list of malicious indicators to check against the records extracted from the backup by MVT. Any matches will be highlighted in the terminal output.
+You can then extract SMSs with MVT by passing the folder path as parameter instead of the `.ab` file: `mvt-android check-backup --output /path/to/results/ /path/to/backup/` (the path to backup given should be the folder containing the `apps` folder).

docs/android/download_apks.md

@@ -1,6 +1,6 @@
 # Downloading APKs from an Android phone
 
-MVT allows to attempt to download all available installed packages (APKs) in order to further inspect them and potentially identify any which might be malicious in nature.
+MVT allows you to attempt to download all available installed packages (APKs) from a device in order to further inspect them and potentially identify any which might be malicious in nature.
 
 You can do so by launching the following command:
 
@@ -13,22 +13,16 @@ It might take several minutes to complete.
 !!! info
     MVT will likely warn you it was unable to download certain installed packages. There is no reason to be alarmed: this is typically expected behavior when MVT attempts to download a system package it has no privileges to access.
 
-Optionally, you can decide to enable lookups of the SHA256 hash of all the extracted APKs on [VirusTotal](https://www.virustotal.com) and/or [Koodous](https://koodous.com). While these lookups do not provide any conclusive assessment on all of the extracted APKs, they might highlight any known malicious ones:
+Optionally, you can decide to enable lookups of the SHA256 hash of all the extracted APKs on [VirusTotal](https://www.virustotal.com). While these lookups do not provide any conclusive assessment on all of the extracted APKs, they might highlight any known malicious ones:
 
 ```bash
-mvt-android download-apks --output /path/to/folder --virustotal
-mvt-android download-apks --output /path/to/folder --koodous
+MVT_VT_API_KEY=<key> mvt-android download-apks --output /path/to/folder --virustotal
 ```
 
-Or, to launch all available lookups:
+Please note that in order to use VirusTotal lookups you are required to provide your own API key through the `MVT_VT_API_KEY` environment variable. You should also note that VirusTotal enforces strict API usage. Be mindful that MVT might consume your hourly search quota.
+
+In case you have a previous extraction of APKs you want to later check against VirusTotal, you can do so with the following arguments:
 
 ```bash
-mvt-android download-apks --output /path/to/folder --all-checks
+MVT_VT_API_KEY=<key> mvt-android download-apks --from-file /path/to/folder/apks.json --virustotal
 ```
-
-In case you have a previous extraction of APKs you want to later check against VirusTotal and Koodous, you can do so with the following arguments:
-
-```bash
-mvt-android download-apks --from-file /path/to/folder/apks.json --all-checks
-```
-

docs/android/methodology.md

@@ -8,8 +8,10 @@ However, not all is lost.
 
 Because malware attacks over Android typically take the form of malicious or backdoored apps, the very first thing you might want to do is to extract and verify all installed Android packages and triage quickly if there are any which stand out as malicious or which might be atypical.
 
-While it is out of the scope of this documentation to dwell into details on how to analyze Android apps, MVT does allow to easily and automatically extract information about installed apps, download copies of them, and quickly lookup services such as [VirusTotal](https://www.virustotal.com) or [Koodous](https://koodous.com) which might quickly indicate known bad apps.
+While it is out of the scope of this documentation to dwell into details on how to analyze Android apps, MVT does allow to easily and automatically extract information about installed apps, download copies of them, and quickly look them up on services such as [VirusTotal](https://www.virustotal.com).
 
+!!! info "Using VirusTotal"
+	Please note that in order to use VirusTotal lookups you are required to provide your own API key through the `MVT_VT_API_KEY` environment variable. You should also note that VirusTotal enforces strict API usage. Be mindful that MVT might consume your hourly search quota.
 
 ## Check the device over Android Debug Bridge
 

docs/command_completion.md

@@ -0,0 +1,43 @@
+# Command Completion 
+
+MVT utilizes the [Click](https://click.palletsprojects.com/en/stable/) library for creating its command line interface. 
+
+Click provides tab completion support for Bash (version 4.4 and up), Zsh, and Fish.
+
+To enable it, you need to manually register a special function with your shell, which varies depending on the shell you are using.
+
+The following describes how to generate the command completion scripts and add them to your shell configuration. 
+
+> **Note: You will need to start a new shell for the changes to take effect.**
+
+### For Bash
+
+```bash
+# Generates bash completion scripts
+echo "$(_MVT_IOS_COMPLETE=bash_source mvt-ios)" > ~/.mvt-ios-complete.bash &&
+echo "$(_MVT_ANDROID_COMPLETE=bash_source mvt-android)" > ~/.mvt-android-complete.bash
+```
+
+Add the following to `~/.bashrc`:
+```bash
+# source mvt completion scripts
+. ~/.mvt-ios-complete.bash && .  ~/.mvt-android-complete.bash
+```
+
+### For Zsh
+
+```bash
+# Generates zsh completion scripts
+echo "$(_MVT_IOS_COMPLETE=zsh_source mvt-ios)" >  ~/.mvt-ios-complete.zsh &&
+echo "$(_MVT_ANDROID_COMPLETE=zsh_source mvt-android)" > ~/.mvt-android-complete.zsh
+```
+
+Add the following to `~/.zshrc`:
+```bash
+# source mvt completion scripts
+.  ~/.mvt-ios-complete.zsh  && .  ~/.mvt-android-complete.zsh
+```
+
+For more information, visit the official [Click Docs](https://click.palletsprojects.com/en/stable/shell-completion/#enabling-completion).
+
+

docs/development.md

@@ -0,0 +1,27 @@
+# Development
+
+The Mobile Verification Toolkit team welcomes contributions of new forensic modules or other contributions which help improve the software.
+
+## Testing
+
+MVT uses `pytest` for unit and integration tests. Code style consistency is maintained with `flake8`, `ruff` and `black`. All can
+be run automatically with:
+
+```bash
+make check
+```
+
+Run these tests before making new commits or opening pull requests.
+
+## Profiling
+
+Some MVT modules extract and process significant amounts of data during the analysis process or while checking results against known indicators. Care must be
+take to avoid inefficient code paths as we add new modules.
+
+MVT modules can be profiled with Python built-in `cProfile` by setting the `MVT_PROFILE` environment variable.
+
+```bash
+MVT_PROFILE=1 dev/mvt-ios check-backup test_backup
+```
+
+Open an issue or PR if you are encountering significant performance issues when analyzing a device with MVT.

docs/docker.md

@@ -1,8 +1,23 @@
-Using Docker simplifies having all the required dependencies and tools (including most recent versions of [libimobiledevice](https://libimobiledevice.org)) readily installed.
+Using Docker simplifies having all the required dependencies and tools (including most recent versions of [libimobiledevice](https://libimobiledevice.org)) readily installed. Note that this requires a Linux host, as Docker for Windows and Mac [doesn't support passing through USB devices](https://docs.docker.com/desktop/faqs/#can-i-pass-through-a-usb-device-to-a-container).
 
 Install Docker following the [official documentation](https://docs.docker.com/get-docker/).
 
-Once installed, you can clone MVT's repository and build its Docker image:
+Once Docker is installed, you can run MVT by downloading a prebuilt MVT Docker image, or by building a Docker image yourself from the MVT source repo.
+
+### Using the prebuilt Docker image
+
+```bash
+docker pull ghcr.io/mvt-project/mvt
+```
+
+You can then run the Docker container with:
+
+```
+docker run -it ghcr.io/mvt-project/mvt
+```
+
+
+### Build and run Docker image from source
 
 ```bash
 git clone https://github.com/mvt-project/mvt.git
@@ -18,6 +33,9 @@ docker run -it mvt
 
 If a prompt is spawned successfully, you can close it with `exit`.
 
+
+## Docker usage with Android devices
+
 If you wish to use MVT to test an Android device you will need to enable the container's access to the host's USB devices. You can do so by enabling the `--privileged` flag and mounting the USB bus device as a volume:
 
 ```bash

docs/index.md

@@ -6,6 +6,9 @@
 
 Mobile Verification Toolkit (MVT) is a tool to facilitate the [consensual forensic analysis](introduction.md#consensual-forensics) of Android and iOS devices, for the purpose of identifying traces of compromise.
 
+It has been developed and released by the [Amnesty International Security Lab](https://securitylab.amnesty.org) in July 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/). It continues to be maintained by Amnesty International and other contributors.
+
+
 In this documentation you will find instructions on how to install and run the `mvt-ios` and `mvt-android` commands, and guidance on how to interpret the extracted results.
 
 ## Resources

docs/install.md

@@ -7,11 +7,27 @@ Before proceeding, please note that MVT requires Python 3.6+ to run. While it sh
 First install some basic dependencies that will be necessary to build all required tools:
 
 ```bash
-sudo apt install python3 python3-pip libusb-1.0-0 sqlite3
+sudo apt install python3 python3-venv python3-pip sqlite3 libusb-1.0-0
 ```
 
 *libusb-1.0-0* is not required if you intend to only use `mvt-ios` and not `mvt-android`.
 
+(Recommended) Set up `pipx`
+
+For Ubuntu 23.04 or above:
+```bash
+sudo apt install pipx
+pipx ensurepath
+```
+
+For Ubuntu 22.04 or below:
+```
+python3 -m pip install --user pipx
+python3 -m pipx ensurepath
+```
+
+Other distributions: check for a `pipx` or `python-pipx` via your package manager.
+
 When working with Android devices you should additionally install [Android SDK Platform Tools](https://developer.android.com/studio/releases/platform-tools). If you prefer to install a package made available by your distribution of choice, please make sure the version is recent to ensure compatibility with modern Android devices.
 
 ## Dependencies on macOS
@@ -21,7 +37,7 @@ Running MVT on macOS requires Xcode and [homebrew](https://brew.sh) to be instal
 In order to install dependencies use:
 
 ```bash
-brew install python3 libusb sqlite3
+brew install python3 pipx libusb sqlite3
 ```
 
 *libusb* is not required if you intend to only use `mvt-ios` and not `mvt-android`.
@@ -42,24 +58,47 @@ It is recommended to try installing and running MVT from [Windows Subsystem Linu
 
 ## Installing MVT
 
-If you haven't done so, you can add this to your `.bashrc` or `.zshrc` file in order to add locally installed Pypi binaries to your `$PATH`:
+### Installing from PyPI with pipx (recommended)
+1. Install `pipx` following the instructions above for your OS/distribution. Make sure to run `pipx ensurepath` and open a new terminal window.
+2. ```bash
+   pipx install mvt
+   ```
 
+You now should have the `mvt-ios` and `mvt-android` utilities installed. If you run into problems with these commands not being found, ensure you have run `pipx ensurepath` and opened a new terminal window.
+
+### Installing from PyPI directly into a virtual environment
+You can use `pipenv`, `poetry` etc. for your virtual environment, but the provided example is with the built-in `venv` tool:
+
+1. Create the virtual environment in a folder in the current directory named `env`:
 ```bash
-export PATH=$PATH:~/.local/bin
+python3 -m venv env
 ```
 
-Then you can install MVT directly from [pypi](https://pypi.org/project/mvt/)
-
+2. Activate the virtual environment:
 ```bash
-pip3 install mvt
+source env/bin/activate
 ```
 
-Or from the source code:
+3. Install `mvt` into the virtual environment:
+```bash
+pip install mvt
+```
+
+The `mvt-ios` and `mvt-android` utilities should now be available as commands whenever the virtual environment is active.
+
+### Installing from git source with pipx
+If you want to have the latest features in development, you can install MVT directly from the source code in git.
 
 ```bash
-git clone https://github.com/mvt-project/mvt.git
-cd mvt
-pip3 install .
+pipx install --force git+https://github.com/mvt-project/mvt.git
 ```
 
 You now should have the `mvt-ios` and `mvt-android` utilities installed.
+
+**Notes:**
+1. The `--force` flag is necessary to force the reinstallation of the package.
+2. To revert to using a PyPI version, it will be necessary to `pipx uninstall mvt` first.
+
+## Setting up command completions
+
+See ["Command completions"](command_completion.md)

docs/introduction.md

@@ -12,6 +12,20 @@ Mobile Verification Toolkit (MVT) is a collection of utilities designed to facil
 
 MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. MVT is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance.
 
+## Indicators of Compromise
+
+MVT supports using [indicators of compromise (IOCs)](https://github.com/mvt-project/mvt-indicators) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by [Amnesty International](https://github.com/AmnestyTech/investigations/) and other research groups.
+
+!!! warning
+    Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.
+
+    Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
+
+    Such support is available to civil society through [Amnesty International's Security Lab](https://securitylab.amnesty.org/get-help/?c=mvt_docs) or [Access Now’s Digital Security Helpline](https://www.accessnow.org/help/).
+
+More information about using indicators of compromise with MVT is available in the [documentation](iocs.md).
+
+
 ## Consensual Forensics
 
 While MVT is capable of extracting and processing various types of very personal records typically found on a mobile phone (such as calls history, SMS and WhatsApp messages, etc.), this is intended to help identify potential attack vectors such as malicious SMS messages leading to exploitation.

docs/iocs.md

@@ -34,13 +34,25 @@ It is also possible to load STIX2 files automatically from the environment varia
 export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2"
 ```
 
+## STIX2 Support
+
+So far MVT implements only a subset of [STIX2 specifications](https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01.html):
+
+* It only supports checks for one value (such as `[domain-name:value='DOMAIN']`) and not boolean expressions over multiple comparisons
+* It only supports the following types: `domain-name:value`, `process:name`, `email-addr:value`, `file:name`, `file:path`, `file:hashes.md5`, `file:hashes.sha1`, `file:hashes.sha256`, `app:id`, `configuration-profile:id`, `android-property:name`, `url:value` (but each type will only be checked by a module if it is relevant to the type of data obtained)
+
 ## Known repositories of STIX2 IOCs
 
 - The [Amnesty International investigations repository](https://github.com/AmnestyTech/investigations) contains STIX-formatted IOCs for:
     - [Pegasus](https://en.wikipedia.org/wiki/Pegasus_(spyware)) ([STIX2](https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-07-18_nso/pegasus.stix2))
     - [Predator from Cytrox](https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/) ([STIX2](https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-12-16_cytrox/cytrox.stix2))
-- [This repository](https://github.com/Te-k/stalkerware-indicators) contains IOCs for Android stalkerware including [a STIX MVT-compatible file](https://raw.githubusercontent.com/Te-k/stalkerware-indicators/master/stalkerware.stix2).
+    - [An Android Spyware Campaign Linked to a Mercenary Company](https://github.com/AmnestyTech/investigations/tree/master/2023-03-29_android_campaign) ([STIX2](https://github.com/AmnestyTech/investigations/blob/master/2023-03-29_android_campaign/malware.stix2))
+- [This repository](https://github.com/Te-k/stalkerware-indicators) contains IOCs for Android stalkerware including [a STIX MVT-compatible file](https://raw.githubusercontent.com/Te-k/stalkerware-indicators/master/generated/stalkerware.stix2).
+- We are also maintaining [a list of IOCs](https://github.com/mvt-project/mvt-indicators) in STIX format from public spyware campaigns.
 
-You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators listed [here](https://github.com/mvt-project/mvt/blob/main/public_indicators.json) and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by mvt.
+You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators from the [mvt-indicators](https://github.com/mvt-project/mvt-indicators/blob/main/indicators.yaml) repository and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by MVT.
 
 Please [open an issue](https://github.com/mvt-project/mvt/issues/) to suggest new sources of STIX-formatted IOCs.
+
+
+

docs/ios/backup/itunes.md

@@ -1,16 +1,41 @@
 # Backup with iTunes app
 
-It is possible to do an iPhone backup by using iTunes on Windows or macOS computers (in most recent versions of macOS, this feature is included in Finder).
+It is possible to do an iPhone backup by using iTunes on Windows or macOS computers (in most recent versions of macOS, this feature is included in Finder, see below).
 
 To do that:
 
-* Make sure iTunes is installed.
-* Connect your iPhone to your computer using a Lightning/USB cable.
-* Open the device in iTunes (or Finder on macOS).
-* If you want to have a more accurate detection, ensure that the encrypted backup option is activated and choose a secure password for the backup.
-* Start the backup and wait for it to finish (this may take up to 30 minutes).
+1. Make sure iTunes is installed.
+2. Connect your iPhone to your computer using a Lightning/USB cable.
+3. Open the device in iTunes (or Finder on macOS).
+4. If you want to have a more accurate detection, ensure that the encrypted backup option is activated and choose a secure password for the backup.
+5. Start the backup and wait for it to finish (this may take up to 30 minutes).
 
-![](../../../img/macos-backup.jpg)
+![](../../img/macos-backup.jpg)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
 
-* Once the backup is done, find its location and copy it to a place where it can be analyzed by MVT. On Windows, the backup can be stored either in `%USERPROFILE%\Apple\MobileSync\` or `%USERPROFILE%\AppData\Roaming\Apple Computer\MobileSync\`. On macOS, the backup is stored in `~/Library/Application Support/MobileSync/`.
+Once the backup is done, find its location and copy it to a place where it can be analyzed by MVT. On Windows, the backup can be stored either in `%USERPROFILE%\Apple\MobileSync\` or `%USERPROFILE%\AppData\Roaming\Apple Computer\MobileSync\`. On macOS, the backup is stored in `~/Library/Application Support/MobileSync/`.
+
+# Backup with Finder
+
+On more recent MacOS versions, this feature is included in Finder. To do a backup:
+
+1. Launch Finder on your Mac.
+2. Connect your iPhone to your Mac using a Lightning/USB cable.
+3. Select your device from the list of devices located at the bottom of the left side bar labeled "locations".
+4. In the General tab, select `Back up all the data on your iPhone to this Mac` from the options under the Backups section.
+5. Check the box that says `Encrypt local backup`. If it is your first time selecting this option, you may need to enter a password to encrypt the backup.
+
+![](../../img/macos-backup2.png)
+_Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
+
+6. Click `Back Up Now` to start the back-up process.
+7. The encrypted backup for your iPhone should now start. Once the process finishes, you can check the backup by opening `Finder`, clicking on the `General` tab, then click on `Manage Backups`. Now you should see a list of your backups like the image below:
+
+![](../../img/macos-backups.png)
+_Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
+
+If your backup has a lock next to it like in the image above, then the backup is encrypted. You should also see the date and time when the encrypted backup was created. The backup files are stored in `~/Library/Application Support/MobileSync/`.
+
+## Notes:
+
+- Remember to keep the backup encryption password that you created safe, since without it you will not be able to access/modify/decrypt the backup file.

docs/ios/backup/libimobiledevice.md

@@ -3,10 +3,10 @@
 If you have correctly [installed libimobiledevice](../install.md) you can easily generate an iTunes backup using the `idevicebackup2` tool included in the suite. First, you might want to ensure that backup encryption is enabled (**note: encrypted backup contain more data than unencrypted backups**):
 
 ```bash
-idevicebackup2 -i backup encryption on
+idevicebackup2 -i encryption on
 ```
 
-Note that if a backup password was previously set on this device, you might need to use the same or change it. You can try changing password using `idevicebackup2 -i backup changepw`, or by turning off encryption (`idevicebackup2 -i backup encryption off`) and turning it back on again.
+Note that if a backup password was previously set on this device, you might need to use the same or change it. You can try changing password using `idevicebackup2 -i changepw`, or by turning off encryption (`idevicebackup2 -i encryption off`) and turning it back on again.
 
 If you are not able to recover or change the password, you should try to disable encryption and obtain an unencrypted backup.
 

docs/ios/install.md

@@ -45,10 +45,10 @@ Once the idevice tools are available you can check if everything works fine by c
 ideviceinfo
 ```
 
-This should some many details on the connected iOS device. If you are connecting the device to your laptop for the first time, it will require to unlock and enter the PIN code on the mobile device. If it complains that no device is connected and the mobile device is indeed plugged in through the USB cable, you might need to do this first, although typically the pairing is automatically done when connecting the device:
+This should show many details on the connected iOS device. If you are connecting the device to your laptop for the first time, it will require to unlock and enter the PIN code on the mobile device. If it complains that no device is connected and the mobile device is indeed plugged in through the USB cable, you might need to do this first, although typically the pairing is automatically done when connecting the device:
 
 ```bash
-sudo usbmuxd -f -d
+sudo usbmuxd -f -v
 idevicepair pair
 ```
 

docs/ios/records.md

@@ -16,9 +16,21 @@ If indicators are provided through the command-line, processes and domains are c
 
 ---
 
+### `applications.json`
+
+!!! info "Availability"
+    Backup: :material-check:
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `Applications` module. The module extracts the list of applications installed on the device from the `Info.plist` file in backup, or from the `iTunesMetadata.plist` files in a file system dump. These records contains detailed information on the source and installation of the app.
+
+If indicators are provided through the command-line, processes and application ids are checked against the app name of each application. It also flags any applications not installed from the AppStore. Any matches are stored in *applications_detected.json*.
+
+---
+
 ### `backup_info.json`
 
-!!! info "Availabiliy"
+!!! info "Availability"
     Backup: :material-check:
     Full filesystem dump: :material-close:
 
@@ -38,6 +50,18 @@ If indicators are provided through the command-line, they are checked against th
 
 ---
 
+### `calendar.json`
+
+!!! info "Availability"
+    Backup: :material-check:
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `Calendar` module. This module extracts all CalendarItems from the `Calendar.sqlitedb` database. This database contains all calendar entries from the different calendars installed on the phone.
+
+If indicators are provided through the command-line, email addresses are checked against the inviter's email of the different events. Any matches are stored in *calendar_detected.json*.
+
+---
+
 ### `calls.json`
 
 !!! info "Availability"
@@ -118,6 +142,16 @@ If indicators are provided through the command-line, they are checked against th
 
 ---
 
+### `global_preferences.json`
+
+!!! info "Availability"
+    Backup: :material-check:
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `GlobalPreferences` module. The module extracts records from a Plist file located at */private/var/mobile/Library/Preferences/.GlobalPreferences.plist*, which contains a system preferences including if Lockdown Mode is enabled.
+
+---
+
 ### `id_status_cache.json`
 
 !!! info "Availability"
@@ -190,7 +224,7 @@ If indicators are provided through the command-line, they are checked against th
     Backup: :material-check:
     Full filesystem dump: :material-check:
 
-This JSON file is created by mvt-ios' `Datausage` module. The module extracts records from a SQLite database located */private/var/wireless/Library/Databases/DataUsage.sqlite*, which contains a history of data usage by processes running on the system. Besides the network statistics, these records are particularly important because they might show traces of malicious process executions and the relevant timeframe. In particular, processes which do not have a valid bundle ID might require particular attention.
+This JSON file is created by mvt-ios' `Datausage` module. The module extracts records from a SQLite database located */private/var/wireless/Library/Databases/DataUsage.sqlite*, which contains a history of network data usage by processes running on the system. It does not log network traffic through WiFi (the fields `WIFI_IN` and `WIFI_OUT` are always empty), and the `WWAN_IN` and `WWAN_OUT` fields are stored in bytes. Besides the network statistics, these records are particularly important because they might show traces of malicious process executions and the relevant timeframe. In particular, processes which do not have a valid bundle ID might require particular attention.
 
 If indicators are provided through the command-line, they are checked against the process names. Any matches are stored in *datausage_detected.json*. If running on a full filesystem dump and if the `--fast` flag was not enabled by command-line, mvt-ios will highlight processes which look suspicious and check the presence of a binary file of the same name in the dump.
 
@@ -272,7 +306,7 @@ If indicators are provided through the command-line, they are checked against th
     Backup: :material-check:
     Full filesystem dump: :material-check:
 
-This JSON file is created by mvt-ios' `SMS` module. The module extracts a list of SMS messages containing HTTP links from the SQLite database located at */private/var/mobile/Library/SMS/sms.db*.
+This JSON file is created by mvt-ios' `SMS` module. The module extracts a list of SMS messages from the SQLite database located at */private/var/mobile/Library/SMS/sms.db*.
 
 If indicators are provided through the command-line, they are checked against the extracted HTTP links. Any matches are stored in *sms_detected.json*.
 
@@ -374,7 +408,7 @@ If indicators are provided through the command-line, they are checked against th
     Backup: :material-check:
     Full filesystem dump: :material-check:
 
-This JSON file is created by mvt-ios' `WhatsApp` module. The module extracts a list of WhatsApp messages containing HTTP links from the SQLite database located at *private/var/mobile/Containers/Shared/AppGroup/\*/ChatStorage.sqlite*.
+This JSON file is created by mvt-ios' `WhatsApp` module. The module extracts a list of WhatsApp messages from the SQLite database located at *private/var/mobile/Containers/Shared/AppGroup/\*/ChatStorage.sqlite*.
 
 If indicators are provided through the command-line, they are checked against the extracted HTTP links. Any matches are stored in *whatsapp_detected.json*.
 

docs/requirements.txt

@@ -1,5 +1,5 @@
-mkdocs==1.2.3
-mkdocs-autorefs
-mkdocs-material
-mkdocs-material-extensions
-mkdocstrings
+mkdocs==1.6.1
+mkdocs-autorefs==1.2.0
+mkdocs-material==9.5.42
+mkdocs-material-extensions==1.3.1
+mkdocstrings==0.23.0

mkdocs.yml

@@ -1,14 +1,14 @@
 site_name: Mobile Verification Toolkit
 repo_url: https://github.com/mvt-project/mvt
 edit_uri: edit/main/docs/
-copyright: Copyright © 2021 MVT Project Developers
+copyright: Copyright © 2021-2023 MVT Project Developers
 site_description: Mobile Verification Toolkit Documentation
 markdown_extensions:
     - attr_list
     - admonition
     - pymdownx.emoji:
-        emoji_index: !!python/name:materialx.emoji.twemoji
-        emoji_generator: !!python/name:materialx.emoji.to_svg
+        emoji_index: !!python/name:material.extensions.emoji.twemoji
+        emoji_generator: !!python/name:material.extensions.emoji.to_svg
     - pymdownx.superfences
     - pymdownx.inlinehilite
     - pymdownx.highlight:
@@ -46,4 +46,5 @@ nav:
         - Check an Android Backup (SMS messages): "android/backup.md"
         - Download APKs: "android/download_apks.md"
     - Indicators of Compromise: "iocs.md"
+    - Development: "development.md"
     - License: "license.md"

mvt/android/cli.py

@@ -1,207 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-import click
-from rich.logging import RichHandler
-
-from mvt.common.help import (HELP_MSG_FAST, HELP_MSG_IOC,
-                             HELP_MSG_LIST_MODULES, HELP_MSG_MODULE,
-                             HELP_MSG_OUTPUT, HELP_MSG_SERIAL)
-from mvt.common.indicators import Indicators, download_indicators_files
-from mvt.common.logo import logo
-from mvt.common.module import run_module, save_timeline
-
-from .download_apks import DownloadAPKs
-from .lookups.koodous import koodous_lookup
-from .lookups.virustotal import virustotal_lookup
-from .modules.adb import ADB_MODULES
-from .modules.backup import BACKUP_MODULES
-
-# Setup logging using Rich.
-LOG_FORMAT = "[%(name)s] %(message)s"
-logging.basicConfig(level="INFO", format=LOG_FORMAT, handlers=[
-    RichHandler(show_path=False, log_time_format="%X")])
-log = logging.getLogger(__name__)
-
-
-#==============================================================================
-# Main
-#==============================================================================
-@click.group(invoke_without_command=False)
-def cli():
-    logo()
-
-
-#==============================================================================
-# Command: version
-#==============================================================================
-@cli.command("version", help="Show the currently installed version of MVT")
-def version():
-    return
-
-
-#==============================================================================
-# Download APKs
-#==============================================================================
-@cli.command("download-apks", help="Download all or non-safelisted installed APKs installed on the device")
-@click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
-@click.option("--all-apks", "-a", is_flag=True,
-              help="Extract all packages installed on the phone, including system packages")
-@click.option("--virustotal", "-v", is_flag=True, help="Check packages on VirusTotal")
-@click.option("--koodous", "-k", is_flag=True, help="Check packages on Koodous")
-@click.option("--all-checks", "-A", is_flag=True, help="Run all available checks")
-@click.option("--output", "-o", type=click.Path(exists=False),
-              help="Specify a path to a folder where you want to store the APKs")
-@click.option("--from-file", "-f", type=click.Path(exists=True),
-              help="Instead of acquiring from phone, load an existing packages.json file for lookups (mainly for debug purposes)")
-@click.pass_context
-def download_apks(ctx, all_apks, virustotal, koodous, all_checks, output, from_file, serial):
-    try:
-        if from_file:
-            download = DownloadAPKs.from_json(from_file)
-        else:
-            # TODO: Do we actually want to be able to run without storing any file?
-            if not output:
-                log.critical("You need to specify an output folder with --output!")
-                ctx.exit(1)
-
-            if not os.path.exists(output):
-                try:
-                    os.makedirs(output)
-                except Exception as e:
-                    log.critical("Unable to create output folder %s: %s", output, e)
-                    ctx.exit(1)
-
-            download = DownloadAPKs(output_folder=output, all_apks=all_apks,
-                                    log=logging.getLogger(DownloadAPKs.__module__))
-            if serial:
-                download.serial = serial
-            download.run()
-
-        packages = download.packages
-
-        if len(packages) == 0:
-            return
-
-        if virustotal or all_checks:
-            virustotal_lookup(packages)
-
-        if koodous or all_checks:
-            koodous_lookup(packages)
-    except KeyboardInterrupt:
-        print("")
-        ctx.exit(1)
-
-
-#==============================================================================
-# Checks through ADB
-#==============================================================================
-@cli.command("check-adb", help="Check an Android device over adb")
-@click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--output", "-o", type=click.Path(exists=False),
-              help=HELP_MSG_OUTPUT)
-@click.option("--fast", "-f", is_flag=True, help=HELP_MSG_FAST)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.pass_context
-def check_adb(ctx, iocs, output, fast, list_modules, module, serial):
-    if list_modules:
-        log.info("Following is the list of available check-adb modules:")
-        for adb_module in ADB_MODULES:
-            log.info(" - %s", adb_module.__name__)
-
-        return
-
-    log.info("Checking Android through adb bridge")
-
-    if output and not os.path.exists(output):
-        try:
-            os.makedirs(output)
-        except Exception as e:
-            log.critical("Unable to create output folder %s: %s", output, e)
-            ctx.exit(1)
-
-    indicators = Indicators(log=log)
-    indicators.load_indicators_files(iocs)
-
-    timeline = []
-    timeline_detected = []
-    for adb_module in ADB_MODULES:
-        if module and adb_module.__name__ != module:
-            continue
-
-        m = adb_module(output_folder=output, fast_mode=fast,
-                       log=logging.getLogger(adb_module.__module__))
-        if indicators.total_ioc_count:
-            m.indicators = indicators
-            m.indicators.log = m.log
-        if serial:
-            m.serial = serial
-
-        run_module(m)
-        timeline.extend(m.timeline)
-        timeline_detected.extend(m.timeline_detected)
-
-    if output:
-        if len(timeline) > 0:
-            save_timeline(timeline, os.path.join(output, "timeline.csv"))
-        if len(timeline_detected) > 0:
-            save_timeline(timeline_detected, os.path.join(output, "timeline_detected.csv"))
-
-
-#==============================================================================
-# Check ADB backup
-#==============================================================================
-@cli.command("check-backup", help="Check an Android Backup")
-@click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
-@click.argument("BACKUP_PATH", type=click.Path(exists=True))
-@click.pass_context
-def check_backup(ctx, iocs, output, backup_path, serial):
-    log.info("Checking ADB backup located at: %s", backup_path)
-
-    if output and not os.path.exists(output):
-        try:
-            os.makedirs(output)
-        except Exception as e:
-            log.critical("Unable to create output folder %s: %s", output, e)
-            ctx.exit(1)
-
-    indicators = Indicators(log=log)
-    indicators.load_indicators_files(iocs)
-
-    if os.path.isfile(backup_path):
-        log.critical("The path you specified is a not a folder!")
-
-        if os.path.basename(backup_path) == "backup.ab":
-            log.info("You can use ABE (https://github.com/nelenkov/android-backup-extractor) "
-                     "to extract 'backup.ab' files!")
-        ctx.exit(1)
-
-    for module in BACKUP_MODULES:
-        m = module(base_folder=backup_path, output_folder=output,
-                   log=logging.getLogger(module.__module__))
-        if indicators.total_ioc_count:
-            m.indicators = indicators
-            m.indicators.log = m.log
-        if serial:
-            m.serial = serial
-
-        run_module(m)
-
-
-#==============================================================================
-# Command: download-iocs
-#==============================================================================
-@cli.command("download-iocs", help="Download public STIX2 indicators")
-def download_indicators():
-    download_indicators_files(log)

mvt/android/data/root_binaries.txt

@@ -1,10 +0,0 @@
-su
-busybox
-supersu
-Superuser.apk
-KingoUser.apk
-SuperSu.apk
-magisk
-magiskhide
-magiskinit
-magiskpolicy

mvt/android/data/root_packages.txt

@@ -1,25 +0,0 @@
-com.noshufou.android.su
-com.noshufou.android.su.elite
-eu.chainfire.supersu
-com.koushikdutta.superuser
-com.thirdparty.superuser
-com.yellowes.su
-com.koushikdutta.rommanager
-com.koushikdutta.rommanager.license
-com.dimonvideo.luckypatcher
-com.chelpus.lackypatch
-com.ramdroid.appquarantine
-com.ramdroid.appquarantinepro
-com.devadvance.rootcloak
-com.devadvance.rootcloakplus
-de.robv.android.xposed.installer
-com.saurik.substrate
-com.zachspong.temprootremovejb
-com.amphoras.hidemyroot
-com.amphoras.hidemyrootadfree
-com.formyhm.hiderootPremium
-com.formyhm.hideroot
-me.phh.superuser
-eu.chainfire.supersu.pro
-com.kingouser.com
-com.topjohnwu.magisk

mvt/android/lookups/koodous.py

@@ -1,58 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-
-import requests
-from rich.console import Console
-from rich.progress import track
-from rich.table import Table
-from rich.text import Text
-
-log = logging.getLogger(__name__)
-
-
-def koodous_lookup(packages):
-    log.info("Looking up all extracted files on Koodous (www.koodous.com)")
-    log.info("This might take a while...")
-
-    table = Table(title="Koodous Packages Detections")
-    table.add_column("Package name")
-    table.add_column("File name")
-    table.add_column("Trusted")
-    table.add_column("Detected")
-    table.add_column("Rating")
-
-    total_packages = len(packages)
-    for i in track(range(total_packages), description=f"Looking up {total_packages} packages..."):
-        package = packages[i]
-        for file in package.get("files", []):
-            url = f"https://api.koodous.com/apks/{file['sha256']}"
-            res = requests.get(url)
-            report = res.json()
-
-            row = [package["package_name"], file["path"]]
-
-            if "package_name" in report:
-                trusted = "no"
-                if report["trusted"]:
-                    trusted = Text("yes", "green bold")
-
-                detected = "no"
-                if report["detected"]:
-                    detected = Text("yes", "red bold")
-
-                rating = "0"
-                if int(report["rating"]) < 0:
-                    rating = Text(str(report["rating"]), "red bold")
-
-                row.extend([trusted, detected, rating])
-            else:
-                row.extend(["n/a", "n/a", "n/a"])
-
-            table.add_row(*row)
-
-    console = Console()
-    console.print(table)

mvt/android/lookups/virustotal.py

@@ -1,96 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-
-import requests
-from rich.console import Console
-from rich.progress import track
-from rich.table import Table
-from rich.text import Text
-
-log = logging.getLogger(__name__)
-
-
-def get_virustotal_report(hashes):
-    apikey = "233f22e200ca5822bd91103043ccac138b910db79f29af5616a9afe8b6f215ad"
-    url = f"https://www.virustotal.com/partners/sysinternals/file-reports?apikey={apikey}"
-
-    items = []
-    for sha256 in hashes:
-        items.append({
-            "autostart_location": "",
-            "autostart_entry": "",
-            "hash": sha256,
-            "local_name": "",
-            "creation_datetime": "",
-        })
-    headers = {"User-Agent": "VirusTotal", "Content-Type": "application/json"}
-    res = requests.post(url, headers=headers, json=items)
-
-    if res.status_code == 200:
-        report = res.json()
-        return report["data"]
-    else:
-        log.error("Unexpected response from VirusTotal: %s", res.status_code)
-        return None
-
-
-def virustotal_lookup(packages):
-    log.info("Looking up all extracted files on VirusTotal (www.virustotal.com)")
-
-    unique_hashes = []
-    for package in packages:
-        for file in package.get("files", []):
-            if file["sha256"] not in unique_hashes:
-                unique_hashes.append(file["sha256"])
-
-    total_unique_hashes = len(unique_hashes)
-
-    detections = {}
-
-    def virustotal_query(batch):
-        report = get_virustotal_report(batch)
-        if not report:
-            return
-
-        for entry in report:
-            if entry["hash"] not in detections and entry["found"] is True:
-                detections[entry["hash"]] = entry["detection_ratio"]
-
-    batch = []
-    for i in track(range(total_unique_hashes), description=f"Looking up {total_unique_hashes} files..."):
-        file_hash = unique_hashes[i]
-        batch.append(file_hash)
-        if len(batch) == 25:
-            virustotal_query(batch)
-            batch = []
-
-    if batch:
-        virustotal_query(batch)
-
-    table = Table(title="VirusTotal Packages Detections")
-    table.add_column("Package name")
-    table.add_column("File path")
-    table.add_column("Detections")
-
-    for package in packages:
-        for file in package.get("files", []):
-            row = [package["package_name"], file["path"]]
-
-            if file["sha256"] in detections:
-                detection = detections[file["sha256"]]
-                positives = detection.split("/")[0]
-                if int(positives) > 0:
-                    row.append(Text(detection, "red bold"))
-                else:
-                    row.append(detection)
-            else:
-                row.append("not found")
-
-            table.add_row(*row)
-
-    console = Console()
-    console.print(table)

mvt/android/modules/adb/__init__.py

@@ -1,24 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .chrome_history import ChromeHistory
-from .dumpsys_accessibility import DumpsysAccessibility
-from .dumpsys_batterystats import DumpsysBatterystats
-from .dumpsys_full import DumpsysFull
-from .dumpsys_packages import DumpsysPackages
-from .dumpsys_procstats import DumpsysProcstats
-from .dumpsys_receivers import DumpsysReceivers
-from .files import Files
-from .logcat import Logcat
-from .packages import Packages
-from .processes import Processes
-from .rootbinaries import RootBinaries
-from .sms import SMS
-from .whatsapp import Whatsapp
-
-ADB_MODULES = [ChromeHistory, SMS, Whatsapp, Processes,
-               DumpsysAccessibility, DumpsysBatterystats, DumpsysProcstats,
-               DumpsysPackages, DumpsysReceivers, DumpsysFull,
-               Packages, RootBinaries, Logcat, Files]

mvt/android/modules/adb/base.py

@@ -1,244 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-import random
-import string
-import sys
-import tempfile
-import time
-
-from adb_shell.adb_device import AdbDeviceTcp, AdbDeviceUsb
-from adb_shell.auth.keygen import keygen, write_public_keyfile
-from adb_shell.auth.sign_pythonrsa import PythonRSASigner
-from adb_shell.exceptions import (AdbCommandFailureException, DeviceAuthError,
-                                  UsbReadFailedError)
-from usb1 import USBErrorAccess, USBErrorBusy
-
-from mvt.common.module import InsufficientPrivileges, MVTModule
-
-log = logging.getLogger(__name__)
-
-ADB_KEY_PATH = os.path.expanduser("~/.android/adbkey")
-ADB_PUB_KEY_PATH = os.path.expanduser("~/.android/adbkey.pub")
-
-
-class AndroidExtraction(MVTModule):
-    """This class provides a base for all Android extraction modules."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.device = None
-        self.serial = None
-
-    @staticmethod
-    def _adb_check_keys():
-        """Make sure Android adb keys exist."""
-        if not os.path.isdir(os.path.dirname(ADB_KEY_PATH)):
-            os.makedirs(os.path.dirname(ADB_KEY_PATH))
-
-        if not os.path.exists(ADB_KEY_PATH):
-            keygen(ADB_KEY_PATH)
-
-        if not os.path.exists(ADB_PUB_KEY_PATH):
-            write_public_keyfile(ADB_KEY_PATH, ADB_PUB_KEY_PATH)
-
-    def _adb_connect(self):
-        """Connect to the device over adb."""
-        self._adb_check_keys()
-
-        with open(ADB_KEY_PATH, "rb") as handle:
-            priv_key = handle.read()
-
-        with open(ADB_PUB_KEY_PATH, "rb") as handle:
-            pub_key = handle.read()
-
-        signer = PythonRSASigner(pub_key, priv_key)
-
-        # If no serial was specified or if the serial does not seem to be
-        # a HOST:PORT definition, we use the USB transport.
-        if not self.serial or ":" not in self.serial:
-            self.device = AdbDeviceUsb(serial=self.serial)
-        # Otherwise we try to use the TCP transport.
-        else:
-            addr = self.serial.split(":")
-            if len(addr) < 2:
-                raise ValueError("TCP serial number must follow the format: `address:port`")
-
-            self.device = AdbDeviceTcp(addr[0], int(addr[1]),
-                                       default_transport_timeout_s=30.)
-
-        while True:
-            try:
-                self.device.connect(rsa_keys=[signer], auth_timeout_s=5)
-            except (USBErrorBusy, USBErrorAccess):
-                log.critical("Device is busy, maybe run `adb kill-server` and try again.")
-                sys.exit(-1)
-            except DeviceAuthError:
-                log.error("You need to authorize this computer on the Android device. Retrying in 5 seconds...")
-                time.sleep(5)
-            except UsbReadFailedError:
-                log.error("Unable to connect to the device over USB. Try to unplug, plug the device and start again.")
-                sys.exit(-1)
-            except OSError as e:
-                if e.errno == 113 and self.serial:
-                    log.critical("Unable to connect to the device %s: did you specify the correct IP addres?",
-                                 self.serial)
-                    sys.exit(-1)
-            else:
-                break
-
-    def _adb_disconnect(self):
-        """Close adb connection to the device."""
-        self.device.close()
-
-    def _adb_reconnect(self):
-        """Reconnect to device using adb."""
-        log.info("Reconnecting ...")
-        self._adb_disconnect()
-        self._adb_connect()
-
-    def _adb_command(self, command):
-        """Execute an adb shell command.
-
-        :param command: Shell command to execute
-        :returns: Output of command
-
-        """
-        return self.device.shell(command, read_timeout_s=200.0)
-
-    def _adb_check_if_root(self):
-        """Check if we have a `su` binary on the Android device.
-
-
-        :returns: Boolean indicating whether a `su` binary is present or not
-
-        """
-        return bool(self._adb_command("command -v su"))
-
-    def _adb_root_or_die(self):
-        """Check if we have a `su` binary, otherwise raise an Exception."""
-        if not self._adb_check_if_root():
-            raise InsufficientPrivileges("This module is optionally available in case the device is already rooted. Do NOT root your own device!")
-
-    def _adb_command_as_root(self, command):
-        """Execute an adb shell command.
-
-        :param command: Shell command to execute as root
-        :returns: Output of command
-
-        """
-        return self._adb_command(f"su -c {command}")
-
-    def _adb_check_file_exists(self, file):
-        """Verify that a file exists.
-
-        :param file: Path of the file
-        :returns: Boolean indicating whether the file exists or not
-
-        """
-
-        # TODO: Need to support checking files without root privileges as well.
-
-        # Connect to the device over adb.
-        self._adb_connect()
-        # Check if we have root, if not raise an Exception.
-        self._adb_root_or_die()
-
-        return bool(self._adb_command_as_root(f"[ ! -f {file} ] || echo 1"))
-
-    def _adb_download(self, remote_path, local_path, progress_callback=None, retry_root=True):
-        """Download a file form the device.
-
-        :param remote_path: Path to download from the device
-        :param local_path: Path to where to locally store the copy of the file
-        :param progress_callback: Callback for download progress bar (Default value = None)
-        :param retry_root: Default value = True)
-
-        """
-        try:
-            self.device.pull(remote_path, local_path, progress_callback)
-        except AdbCommandFailureException as e:
-            if retry_root:
-                self._adb_download_root(remote_path, local_path, progress_callback)
-            else:
-                raise Exception(f"Unable to download file {remote_path}: {e}")
-
-    def _adb_download_root(self, remote_path, local_path, progress_callback=None):
-        try:
-            # Check if we have root, if not raise an Exception.
-            self._adb_root_or_die()
-
-            # We generate a random temporary filename.
-            tmp_filename = "tmp_" + ''.join(random.choices(string.ascii_uppercase + string.ascii_lowercase + string.digits, k=10))
-
-            # We create a temporary local file.
-            new_remote_path = f"/sdcard/{tmp_filename}"
-
-            # We copy the file from the data folder to /sdcard/.
-            cp = self._adb_command_as_root(f"cp {remote_path} {new_remote_path}")
-            if cp.startswith("cp: ") and "No such file or directory" in cp:
-                raise Exception(f"Unable to process file {remote_path}: File not found")
-            elif cp.startswith("cp: ") and "Permission denied" in cp:
-                raise Exception(f"Unable to process file {remote_path}: Permission denied")
-
-            # We download from /sdcard/ to the local temporary file.
-            # If it doesn't work now, don't try again (retry_root=False)
-            self._adb_download(new_remote_path, local_path, retry_root=False)
-
-            # Delete the copy on /sdcard/.
-            self._adb_command(f"rm -rf {new_remote_path}")
-
-        except AdbCommandFailureException as e:
-            raise Exception(f"Unable to download file {remote_path}: {e}")
-
-    def _adb_process_file(self, remote_path, process_routine):
-        """Download a local copy of a file which is only accessible as root.
-        This is a wrapper around process_routine.
-
-        :param remote_path: Path of the file on the device to process
-        :param process_routine: Function to be called on the local copy of the
-                                downloaded file
-
-        """
-        # Connect to the device over adb.
-        self._adb_connect()
-        # Check if we have root, if not raise an Exception.
-        self._adb_root_or_die()
-
-        # We create a temporary local file.
-        tmp = tempfile.NamedTemporaryFile()
-        local_path = tmp.name
-        local_name = os.path.basename(tmp.name)
-        new_remote_path = f"/sdcard/Download/{local_name}"
-
-        # We copy the file from the data folder to /sdcard/.
-        cp = self._adb_command_as_root(f"cp {remote_path} {new_remote_path}")
-        if cp.startswith("cp: ") and "No such file or directory" in cp:
-            raise Exception(f"Unable to process file {remote_path}: File not found")
-        elif cp.startswith("cp: ") and "Permission denied" in cp:
-            raise Exception(f"Unable to process file {remote_path}: Permission denied")
-
-        # We download from /sdcard/ to the local temporary file.
-        self._adb_download(new_remote_path, local_path)
-
-        # Launch the provided process routine!
-        process_routine(local_path)
-
-        # Delete the local copy.
-        tmp.close()
-        # Delete the copy on /sdcard/.
-        self._adb_command(f"rm -f {new_remote_path}")
-        # Disconnect from the device.
-        self._adb_disconnect()
-
-    def run(self):
-        """Run the main procedure."""
-        raise NotImplementedError

mvt/android/modules/adb/chrome_history.py

@@ -1,82 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-import sqlite3
-
-from mvt.common.utils import (convert_chrometime_to_unix,
-                              convert_timestamp_to_iso)
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-CHROME_HISTORY_PATH = "data/data/com.android.chrome/app_chrome/Default/History"
-
-
-class ChromeHistory(AndroidExtraction):
-    """This module extracts records from Android's Chrome browsing history."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "visit",
-            "data": f"{record['id']} - {record['url']} (visit ID: {record['visit_id']}, redirect source: {record['redirect_source']})"
-        }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if self.indicators.check_domain(result["url"]):
-                self.detected.append(result)
-
-    def _parse_db(self, db_path):
-        """Parse a Chrome History database file.
-
-        :param db_path: Path to the History database to process.
-
-        """
-        conn = sqlite3.connect(db_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                urls.id,
-                urls.url,
-                visits.id,
-                visits.visit_time,
-                visits.from_visit
-            FROM urls
-            JOIN visits ON visits.url = urls.id
-            ORDER BY visits.visit_time;
-        """)
-
-        for item in cur:
-            self.results.append({
-                "id": item[0],
-                "url": item[1],
-                "visit_id": item[2],
-                "timestamp": item[3],
-                "isodate": convert_timestamp_to_iso(convert_chrometime_to_unix[item[3]]),
-                "redirect_source": item[4],
-            })
-
-        cur.close()
-        conn.close()
-
-        log.info("Extracted a total of %d history items", len(self.results))
-
-    def run(self):
-        self._adb_process_file(os.path.join("/", CHROME_HISTORY_PATH),
-                               self._parse_db)

mvt/android/modules/adb/dumpsys_accessibility.py

@@ -1,53 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import io
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class DumpsysAccessibility(AndroidExtraction):
-    """This module extracts stats on accessibility."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        stats = self._adb_command("dumpsys accessibility")
-
-        in_services = False
-        for line in stats.split("\n"):
-            if line.strip().startswith("installed services:"):
-                in_services = True
-                continue
-
-            if not in_services:
-                continue
-
-            if line.strip() == "}":
-                break
-
-            service = line.split(":")[1].strip()
-            log.info("Found installed accessibility service \"%s\"", service)
-
-        if self.output_folder:
-            acc_path = os.path.join(self.output_folder,
-                                      "dumpsys_accessibility.txt")
-            with io.open(acc_path, "w", encoding="utf-8") as handle:
-                handle.write(stats)
-
-            log.info("Records from dumpsys accessibility stored at %s",
-                     acc_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_batterystats.py

@@ -1,46 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class DumpsysBatterystats(AndroidExtraction):
-    """This module extracts stats on battery consumption by processes."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        stats = self._adb_command("dumpsys batterystats")
-        if self.output_folder:
-            stats_path = os.path.join(self.output_folder,
-                                      "dumpsys_batterystats.txt")
-            with open(stats_path, "w") as handle:
-                handle.write(stats)
-
-            log.info("Records from dumpsys batterystats stored at %s",
-                     stats_path)
-
-        history = self._adb_command("dumpsys batterystats --history")
-        if self.output_folder:
-            history_path = os.path.join(self.output_folder,
-                                        "dumpsys_batterystats_history.txt")
-            with open(history_path, "w") as handle:
-                handle.write(history)
-
-            log.info("History records from dumpsys batterystats stored at %s",
-                     history_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_full.py

@@ -1,36 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class DumpsysFull(AndroidExtraction):
-    """This module extracts stats on battery consumption by processes."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        stats = self._adb_command("dumpsys")
-        if self.output_folder:
-            stats_path = os.path.join(self.output_folder,
-                                      "dumpsys.txt")
-            with open(stats_path, "w") as handle:
-                handle.write(stats)
-
-            log.info("Full dumpsys output stored at %s",
-                     stats_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_packages.py

@@ -1,37 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class DumpsysPackages(AndroidExtraction):
-    """This module extracts details on installed packages."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        output = self._adb_command("dumpsys package")
-
-        if self.output_folder:
-            packages_path = os.path.join(self.output_folder,
-                                         "dumpsys_packages.txt")
-            with open(packages_path, "w") as handle:
-                handle.write(output)
-
-            log.info("Records from dumpsys package stored at %s",
-                     packages_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_procstats.py

@@ -1,36 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class DumpsysProcstats(AndroidExtraction):
-    """This module extracts stats on memory consumption by processes."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        output = self._adb_command("dumpsys procstats")
-        if self.output_folder:
-            procstats_path = os.path.join(self.output_folder,
-                                          "dumpsys_procstats.txt")
-            with open(procstats_path, "w") as handle:
-                handle.write(output)
-
-            log.info("Records from dumpsys procstats stored at %s",
-                     procstats_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_receivers.py

@@ -1,87 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-ACTION_NEW_OUTGOING_SMS = "android.provider.Telephony.NEW_OUTGOING_SMS"
-ACTION_SMS_RECEIVED = "android.provider.Telephony.SMS_RECEIVED"
-ACTION_DATA_SMS_RECEIVED = "android.intent.action.DATA_SMS_RECEIVED"
-ACTION_PHONE_STATE = "android.intent.action.PHONE_STATE"
-
-
-class DumpsysReceivers(AndroidExtraction):
-    """This module extracts details on receivers for risky activities."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        output = self._adb_command("dumpsys package")
-        if not output:
-            return
-
-        activity = None
-        for line in output.split("\n"):
-            # Find activity block markers.
-            if line.strip().startswith(ACTION_NEW_OUTGOING_SMS):
-                activity = ACTION_NEW_OUTGOING_SMS
-                continue
-            elif line.strip().startswith(ACTION_SMS_RECEIVED):
-                activity = ACTION_SMS_RECEIVED
-                continue
-            elif line.strip().startswith(ACTION_PHONE_STATE):
-                activity = ACTION_PHONE_STATE
-                continue
-            elif line.strip().startswith(ACTION_DATA_SMS_RECEIVED):
-                activity = ACTION_DATA_SMS_RECEIVED
-                continue
-
-            # If we are not in an activity block yet, skip.
-            if not activity:
-                continue
-
-            # If we are in a block but the line does not start with 8 spaces
-            # it means the block ended a new one started, so we reset and
-            # continue.
-            if not line.startswith(" " * 8):
-                activity = None
-                continue
-
-            # If we got this far, we are processing receivers for the
-            # activities we are interested in.
-            receiver = line.strip().split(" ")[1]
-            package_name = receiver.split("/")[0]
-            if package_name == "com.google.android.gms":
-                continue
-
-            if activity == ACTION_NEW_OUTGOING_SMS:
-                self.log.info("Found a receiver to intercept outgoing SMS messages: \"%s\"",
-                              receiver)
-            elif activity == ACTION_SMS_RECEIVED:
-                self.log.info("Found a receiver to intercept incoming SMS messages: \"%s\"",
-                              receiver)
-            elif activity == ACTION_DATA_SMS_RECEIVED:
-                self.log.info("Found a receiver to intercept incoming data SMS message: \"%s\"",
-                              receiver)
-            elif activity == ACTION_PHONE_STATE:
-                self.log.info("Found a receiver monitoring telephony state: \"%s\"",
-                              receiver)
-
-            self.results.append({
-                "activity": activity,
-                "package_name": package_name,
-                "receiver": receiver,
-            })
-
-        self._adb_disconnect()

mvt/android/modules/adb/files.py

@@ -1,119 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import datetime
-import logging
-import stat
-
-from mvt.common.utils import convert_timestamp_to_iso
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class Files(AndroidExtraction):
-    """This module extracts the list of files on the device."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-        self.full_find = None
-
-    def find_path(self, file_path):
-        """Checks if Android system supports full find command output"""
-        # Check find command params on first run
-        # Run find command with correct args and parse results.
-
-        # Check that full file printf options are suppported on first run.
-        if self.full_find is None:
-            output = self._adb_command("find '/' -maxdepth 1 -printf '%T@ %m %s %u %g %p\n' 2> /dev/null")
-            if not (output or output.strip().splitlines()):
-                # Full  find command failed to generate output, fallback to basic file arguments
-                self.full_find = False
-            else:
-                self.full_find = True
-
-        found_files = []
-        if self.full_find is True:
-            # Run full file command and collect additonal file information.
-            output = self._adb_command(f"find '{file_path}' -printf '%T@ %m %s %u %g %p\n' 2> /dev/null")
-            for file_line in output.splitlines():
-                [unix_timestamp, mode, size, owner, group, full_path] = file_line.rstrip().split(" ", 5)
-                mod_time = convert_timestamp_to_iso(datetime.datetime.utcfromtimestamp(int(float(unix_timestamp))))
-                found_files.append({
-                    "path": full_path,
-                    "modified_time": mod_time,
-                    "mode": mode,
-                    "is_suid": (int(mode, 8) & stat.S_ISUID) == 2048,
-                    "is_sgid": (int(mode, 8) & stat.S_ISGID) == 1024,
-                    "size": size,
-                    "owner": owner,
-                    "group": group,
-                })
-        else:
-            # Run a basic listing of file paths.
-            output = self._adb_command(f"find '{file_path}' 2> /dev/null")
-            for file_line in output.splitlines():
-                found_files.append({
-                    "path": file_line.rstrip()
-                })
-
-        return found_files
-
-    def serialize(self, record):
-        if "modified_time" in record:
-            return {
-                "timestamp": record["modified_time"],
-                "module": self.__class__.__name__,
-                "event": "file_modified",
-                "data": record["path"],
-            }
-
-    def check_suspicious(self):
-        """Check for files with suspicious permissions"""
-        for result in sorted(self.results, key=lambda item: item["path"]):
-            if result.get("is_suid"):
-                self.log.warning("Found an SUID file in a non-standard directory \"%s\".",
-                                 result["path"])
-                self.detected.append(result)
-
-    def check_indicators(self):
-        """Check file list for known suspicious files or suspicious properties"""
-        self.check_suspicious()
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if self.indicators.check_file_path(result["path"]):
-                self.log.warning("Found a known suspicous file at path: \"%s\"", result["path"])
-                self.detected.append(result)
-
-    def run(self):
-        self._adb_connect()
-        found_file_paths = []
-
-        DATA_PATHS = ["/data/local/tmp/", "/sdcard/", "/tmp/"]
-        for path in DATA_PATHS:
-            file_info = self.find_path(path)
-            found_file_paths.extend(file_info)
-
-        # Store results
-        self.results.extend(found_file_paths)
-        self.log.info("Found %s files in primary Android data directories.", len(found_file_paths))
-
-        if self.fast_mode:
-            self.log.info("Flag --fast was enabled: skipping full file listing")
-        else:
-            self.log.info("Flag --fast was not enabled: processing full file listing. "
-                          "This may take a while...")
-            output = self.find_path("/")
-            if output and self.output_folder:
-                self.results.extend(output)
-                log.info("List of visible files stored in files.json")
-
-        self._adb_disconnect()

mvt/android/modules/adb/logcat.py

@@ -1,48 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class Logcat(AndroidExtraction):
-    """This module extracts details on installed packages."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        # Get the current logcat.
-        output = self._adb_command("logcat -d")
-        # Get the locat prior to last reboot.
-        last_output = self._adb_command("logcat -L")
-
-        if self.output_folder:
-            logcat_path = os.path.join(self.output_folder,
-                                       "logcat.txt")
-            with open(logcat_path, "w") as handle:
-                handle.write(output)
-
-            log.info("Current logcat logs stored at %s",
-                     logcat_path)
-
-            logcat_last_path = os.path.join(self.output_folder,
-                                            "logcat_last.txt")
-            with open(logcat_last_path, "w") as handle:
-                handle.write(last_output)
-
-            log.info("Logcat logs prior to last reboot stored at %s",
-                     logcat_last_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/packages.py

@@ -1,170 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-import pkg_resources
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class Packages(AndroidExtraction):
-    """This module extracts the list of installed packages."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        records = []
-
-        timestamps = [
-            {"event": "package_install", "timestamp": record["timestamp"]},
-            {"event": "package_first_install", "timestamp": record["first_install_time"]},
-            {"event": "package_last_update", "timestamp": record["last_update_time"]},
-        ]
-
-        for ts in timestamps:
-            records.append({
-                "timestamp": ts["timestamp"],
-                "module": self.__class__.__name__,
-                "event": ts["event"],
-                "data": f"{record['package_name']} (system: {record['system']}, third party: {record['third_party']})",
-            })
-
-        return records
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        root_packages_path = os.path.join("..", "..", "data", "root_packages.txt")
-        root_packages_string = pkg_resources.resource_string(__name__, root_packages_path)
-        root_packages = root_packages_string.decode("utf-8").split("\n")
-        root_packages = [rp.strip() for rp in root_packages]
-
-        for result in self.results:
-            if result["package_name"] in root_packages:
-                self.log.warning("Found an installed package related to rooting/jailbreaking: \"%s\"",
-                                 result["package_name"])
-                self.detected.append(result)
-            if result["package_name"] in self.indicators.ioc_app_ids:
-                self.log.warning("Found a malicious package name: \"%s\"",
-                                 result["package_name"])
-                self.detected.append(result)
-                for file in result["files"]:
-                    if file["sha256"] in self.indicators.ioc_files_sha256:
-                        self.log.warning("Found a malicious APK: \"%s\" %s",
-                                         result["package_name"],
-                                         file["sha256"])
-                        self.detected.append(result)
-
-    def _get_files_for_package(self, package_name):
-        output = self._adb_command(f"pm path {package_name}")
-        output = output.strip().replace("package:", "")
-        if not output:
-            return []
-
-        package_files = []
-        for file_path in output.split("\n"):
-            file_path = file_path.strip()
-
-            md5 = self._adb_command(f"md5sum {file_path}").split(" ")[0]
-            sha1 = self._adb_command(f"sha1sum {file_path}").split(" ")[0]
-            sha256 = self._adb_command(f"sha256sum {file_path}").split(" ")[0]
-            sha512 = self._adb_command(f"sha512sum {file_path}").split(" ")[0]
-
-            package_files.append({
-                "path": file_path,
-                "md5": md5,
-                "sha1": sha1,
-                "sha256": sha256,
-                "sha512": sha512,
-            })
-
-        return package_files
-
-    def run(self):
-        self._adb_connect()
-
-        packages = self._adb_command("pm list packages -U -u -i -f")
-        if packages.strip() == "Error: Unknown option: -U":
-            packages = self._adb_command("pm list packages -u -i -f")
-
-        for line in packages.split("\n"):
-            line = line.strip()
-            if not line.startswith("package:"):
-                continue
-
-            fields = line.split()
-            file_name, package_name = fields[0].split(":")[1].rsplit("=", 1)
-
-            try:
-                installer = fields[1].split("=")[1].strip()
-            except IndexError:
-                installer = None
-            else:
-                if installer == "null":
-                    installer = None
-
-            try:
-                uid = fields[2].split(":")[1].strip()
-            except IndexError:
-                uid = None
-
-            dumpsys = self._adb_command(f"dumpsys package {package_name} | grep -A2 timeStamp").split("\n")
-            timestamp = dumpsys[0].split("=")[1].strip()
-            first_install = dumpsys[1].split("=")[1].strip()
-            last_update = dumpsys[2].split("=")[1].strip()
-
-            package_files = self._get_files_for_package(package_name)
-
-            self.results.append({
-                "package_name": package_name,
-                "file_name": file_name,
-                "installer": installer,
-                "timestamp": timestamp,
-                "first_install_time": first_install,
-                "last_update_time": last_update,
-                "uid": uid,
-                "disabled": False,
-                "system": False,
-                "third_party": False,
-                "files": package_files,
-            })
-
-        cmds = [
-            {"field": "disabled", "arg": "-d"},
-            {"field": "system", "arg": "-s"},
-            {"field": "third_party", "arg": "-3"},
-        ]
-        for cmd in cmds:
-            output = self._adb_command(f"pm list packages {cmd['arg']}")
-            for line in output.split("\n"):
-                line = line.strip()
-                if not line.startswith("package:"):
-                    continue
-
-                package_name = line.split(":", 1)[1]
-                for i, result in enumerate(self.results):
-                    if result["package_name"] == package_name:
-                        self.results[i][cmd["field"]] = True
-
-        for result in self.results:
-            if result["system"]:
-                continue
-
-            self.log.info("Found non-system package with name \"%s\" installed by \"%s\" on %s",
-                          result["package_name"], result["installer"], result["timestamp"])
-
-        self.log.info("Extracted at total of %d installed package names",
-                      len(self.results))
-
-        self._adb_disconnect()

mvt/android/modules/adb/processes.py

@@ -1,55 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class Processes(AndroidExtraction):
-    """This module extracts details on running processes."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        output = self._adb_command("ps -e")
-
-        for line in output.split("\n")[1:]:
-            line = line.strip()
-            if line == "":
-                continue
-
-            fields = line.split()
-            proc = {
-                "user": fields[0],
-                "pid": fields[1],
-                "parent_pid": fields[2],
-                "vsize": fields[3],
-                "rss": fields[4],
-            }
-
-            # Sometimes WCHAN is empty, so we need to re-align output fields.
-            if len(fields) == 8:
-                proc["wchan"] = ""
-                proc["pc"] = fields[5]
-                proc["name"] = fields[7]
-            elif len(fields) == 9:
-                proc["wchan"] = fields[5]
-                proc["pc"] = fields[6]
-                proc["name"] = fields[8]
-
-            self.results.append(proc)
-
-        self._adb_disconnect()
-
-        log.info("Extracted records on a total of %d processes", len(self.results))

mvt/android/modules/adb/rootbinaries.py

@@ -1,49 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-import pkg_resources
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class RootBinaries(AndroidExtraction):
-    """This module extracts the list of installed packages."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        root_binaries_path = os.path.join("..", "..", "data", "root_binaries.txt")
-        root_binaries_string = pkg_resources.resource_string(__name__, root_binaries_path)
-        root_binaries = root_binaries_string.decode("utf-8").split("\n")
-
-        self._adb_connect()
-
-        for root_binary in root_binaries:
-            root_binary = root_binary.strip()
-            if not root_binary:
-                continue
-
-            output = self._adb_command(f"which -a {root_binary}")
-            output = output.strip()
-
-            if not output:
-                continue
-
-            if "which: not found" in output:
-                continue
-
-            self.detected.append(root_binary)
-            self.log.warning("Found root binary \"%s\"", root_binary)
-
-        self._adb_disconnect()

mvt/android/modules/adb/sms.py

@@ -1,115 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-import sqlite3
-
-from mvt.common.utils import check_for_links, convert_timestamp_to_iso
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-SMS_BUGLE_PATH = "data/data/com.google.android.apps.messaging/databases/bugle_db"
-SMS_BUGLE_QUERY = """
-SELECT
-    ppl.normalized_destination AS number,
-    p.timestamp AS timestamp,
-CASE WHEN m.sender_id IN
-(SELECT _id FROM participants WHERE contact_id=-1)
-THEN 2 ELSE 1 END incoming, p.text AS text
-FROM messages m, conversations c, parts p,
-        participants ppl, conversation_participants cp
-WHERE (m.conversation_id = c._id)
-    AND (m._id = p.message_id)
-    AND (cp.conversation_id = c._id)
-    AND (cp.participant_id = ppl._id);
-"""
-
-SMS_MMSSMS_PATH = "data/data/com.android.providers.telephony/databases/mmssms.db"
-SMS_MMSMS_QUERY = """
-SELECT
-    address AS number,
-    date_sent AS timestamp,
-    type as incoming,
-    body AS text
-FROM sms;
-"""
-
-
-class SMS(AndroidExtraction):
-    """This module extracts all SMS messages containing links."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        text = record["text"].replace("\n", "\\n")
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": f"sms_{record['direction']}",
-            "data": f"{record['number']}: \"{text}\""
-        }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for message in self.results:
-            if "text" not in message:
-                continue
-
-            message_links = check_for_links(message["text"])
-            if self.indicators.check_domains(message_links):
-                self.detected.append(message)
-
-    def _parse_db(self, db_path):
-        """Parse an Android bugle_db SMS database file.
-
-        :param db_path: Path to the Android SMS database file to process
-
-        """
-        conn = sqlite3.connect(db_path)
-        cur = conn.cursor()
-
-        if (self.SMS_DB_TYPE == 1):
-            cur.execute(SMS_BUGLE_QUERY)
-        elif (self.SMS_DB_TYPE == 2):
-            cur.execute(SMS_MMSMS_QUERY)
-
-        names = [description[0] for description in cur.description]
-
-        for item in cur:
-            message = {}
-            for index, value in enumerate(item):
-                message[names[index]] = value
-
-            message["direction"] = ("received" if message["incoming"] == 1 else "sent")
-            message["isodate"] = convert_timestamp_to_iso(message["timestamp"])
-
-            # If we find links in the messages or if they are empty we add
-            # them to the list of results.
-            if check_for_links(message["text"]) or message["text"].strip() == "":
-                self.results.append(message)
-
-        cur.close()
-        conn.close()
-
-        log.info("Extracted a total of %d SMS messages containing links", len(self.results))
-
-    def run(self):
-        if (self._adb_check_file_exists(os.path.join("/", SMS_BUGLE_PATH))):
-            self.SMS_DB_TYPE = 1
-            self._adb_process_file(os.path.join("/", SMS_BUGLE_PATH), self._parse_db)
-        elif (self._adb_check_file_exists(os.path.join("/", SMS_MMSSMS_PATH))):
-            self.SMS_DB_TYPE = 2
-            self._adb_process_file(os.path.join("/", SMS_MMSSMS_PATH), self._parse_db)
-        else:
-            self.log.error("No SMS database found")

mvt/android/modules/backup/sms.py

@@ -1,64 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import json
-import os
-import zlib
-
-from mvt.common.module import MVTModule
-from mvt.common.utils import check_for_links
-
-
-class SMS(MVTModule):
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for message in self.results:
-            if "body" not in message:
-                continue
-
-            message_links = check_for_links(message["body"])
-            if self.indicators.check_domains(message_links):
-                self.detected.append(message)
-
-    def _process_sms_file(self, file_path):
-        self.log.info("Processing SMS backup file at %s", file_path)
-
-        with open(file_path, "rb") as handle:
-            data = zlib.decompress(handle.read())
-            json_data = json.loads(data)
-
-        for entry in json_data:
-            message_links = check_for_links(entry["body"])
-
-            # If we find links in the messages or if they are empty we add them to the list.
-            if message_links or entry["body"].strip() == "":
-                self.results.append(entry)
-
-    def run(self):
-        app_folder = os.path.join(self.base_folder,
-                                  "apps",
-                                  "com.android.providers.telephony",
-                                  "d_f")
-        if not os.path.exists(app_folder):
-            raise FileNotFoundError("Unable to find the SMS backup folder")
-
-        for file_name in os.listdir(app_folder):
-            if not file_name.endswith("_sms_backup"):
-                continue
-
-            file_path = os.path.join(app_folder, file_name)
-            self._process_sms_file(file_path)
-
-        self.log.info("Extracted a total of %d SMS messages containing links",
-                      len(self.results))

mvt/common/help.py

@@ -1,14 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-# Help messages of repeating options.
-HELP_MSG_OUTPUT = "Specify a path to a folder where you want to store JSON results"
-HELP_MSG_IOC = "Path to indicators file (can be invoked multiple time)"
-HELP_MSG_FAST = "Avoid running time/resource consuming features"
-HELP_MSG_LIST_MODULES = "Print list of available modules and exit"
-HELP_MSG_MODULE = "Name of a single module you would like to run instead of all"
-
-# Android-specific.
-HELP_MSG_SERIAL = "Specify a device serial number or HOST:PORT connection string"

mvt/common/indicators.py

@@ -1,424 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import io
-import json
-import os
-
-import requests
-from appdirs import user_data_dir
-
-from .url import URL
-
-
-class Indicators:
-    """This class is used to parse indicators from a STIX2 file and provide
-    functions to compare extracted artifacts to the indicators.
-    """
-
-    def __init__(self, log=None):
-        self.data_dir = user_data_dir("mvt")
-        self.log = log
-        self.ioc_files = []
-        self.total_ioc_count = 0
-
-    def _load_downloaded_indicators(self):
-        if not os.path.isdir(self.data_dir):
-            return False
-
-        for f in os.listdir(self.data_dir):
-            if f.lower().endswith(".stix2"):
-                self.parse_stix2(os.path.join(self.data_dir, f))
-
-    def _check_stix2_env_variable(self):
-        """
-        Checks if a variable MVT_STIX2 contains path to STIX Files.
-        """
-        if "MVT_STIX2" not in os.environ:
-            return False
-
-        paths = os.environ["MVT_STIX2"].split(":")
-        for path in paths:
-            if os.path.isfile(path):
-                self.parse_stix2(path)
-            else:
-                self.log.info("Invalid STIX2 path %s in MVT_STIX2 environment variable", path)
-
-    def _generate_indicators_file(self):
-        return {
-            "name": "",
-            "description": "",
-            "file_name": "",
-            "file_path": "",
-            "domains": [],
-            "processes": [],
-            "emails": [],
-            "file_names": [],
-            "file_paths": [],
-            "files_sha256": [],
-            "app_ids": [],
-            "ios_profile_ids": [],
-            "count": 0,
-        }
-
-    def _add_indicator(self, ioc, ioc_file, iocs_list):
-        if ioc not in iocs_list:
-            iocs_list.append(ioc)
-            ioc_file["count"] += 1
-            self.total_ioc_count += 1
-
-    def parse_stix2(self, file_path):
-        """Extract indicators from a STIX2 file.
-
-        :param file_path: Path to the STIX2 file to parse
-        :type file_path: str
-
-        """
-        self.log.info("Parsing STIX2 indicators file at path %s", file_path)
-
-        ioc_file = self._generate_indicators_file()
-        ioc_file["file_path"] = file_path
-        ioc_file["file_name"] = os.path.basename(file_path)
-
-        with open(file_path, "r") as handle:
-            try:
-                data = json.load(handle)
-            except json.decoder.JSONDecodeError:
-                self.log.critical("Unable to parse STIX2 indicator file. The file is malformed or in the wrong format.")
-                return
-
-        for entry in data.get("objects", []):
-            entry_type = entry.get("type", "")
-            if entry_type == "malware":
-                ioc_file["name"] = entry.get("name", "") or ioc_file["file_name"]
-                ioc_file["description"] = entry.get("description", "") or ioc_file["file_name"]
-                continue
-
-            if entry_type != "indicator":
-                continue
-
-            key, value = entry.get("pattern", "").strip("[]").split("=")
-            value = value.strip("'")
-
-            if key == "domain-name:value":
-                # We force domain names to lower case.
-                self._add_indicator(ioc=value.lower(),
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["domains"])
-            elif key == "process:name":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["processes"])
-            elif key == "email-addr:value":
-                # We force email addresses to lower case.
-                self._add_indicator(ioc=value.lower(),
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["emails"])
-            elif key == "file:name":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["file_names"])
-            elif key == "file:path":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["file_paths"])
-            elif key == "file:hashes.sha256":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["files_sha256"])
-            elif key == "app:id":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["app_ids"])
-            elif key == "configuration-profile:id":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["ios_profile_ids"])
-
-        self.log.info("Loaded %d indicators from \"%s\" indicators file",
-                      ioc_file["count"], ioc_file["name"])
-
-        self.ioc_files.append(ioc_file)
-
-    def load_indicators_files(self, files, load_default=True):
-        """
-        Load a list of indicators files.
-        """
-        for file_path in files:
-            if os.path.isfile(file_path):
-                self.parse_stix2(file_path)
-            else:
-                self.log.warning("This indicators file %s does not exist", file_path)
-
-        # Load downloaded indicators and any indicators from env variable.
-        if load_default:
-            self._load_downloaded_indicators()
-
-        self._check_stix2_env_variable()
-        self.log.info("Loaded a total of %d unique indicators", self.total_ioc_count)
-
-    def get_iocs(self, ioc_type):
-        for ioc_file in self.ioc_files:
-            for ioc in ioc_file.get(ioc_type, []):
-                yield {
-                    "value": ioc,
-                    "name": ioc_file["name"]
-                }
-
-    def check_domain(self, url) -> bool:
-        """Check if a given URL matches any of the provided domain indicators.
-
-        :param url: URL to match against domain indicators
-        :type url: str
-        :returns: True if the URL matched an indicator, otherwise False
-        :rtype: bool
-
-        """
-        # TODO: If the IOC domain contains a subdomain, it is not currently
-        #       being matched.
-        if not url:
-            return False
-
-        try:
-            # First we use the provided URL.
-            orig_url = URL(url)
-
-            if orig_url.check_if_shortened():
-                # If it is, we try to retrieve the actual URL making an
-                # HTTP HEAD request.
-                unshortened = orig_url.unshorten()
-
-                # self.log.info("Found a shortened URL %s -> %s",
-                #               url, unshortened)
-
-                # Now we check for any nested URL shorteners.
-                dest_url = URL(unshortened)
-                if dest_url.check_if_shortened():
-                    # self.log.info("Original URL %s appears to shorten another shortened URL %s ... checking!",
-                    #               orig_url.url, dest_url.url)
-                    return self.check_domain(dest_url.url)
-
-                final_url = dest_url
-            else:
-                # If it's not shortened, we just use the original URL object.
-                final_url = orig_url
-        except Exception:
-            # If URL parsing failed, we just try to do a simple substring
-            # match.
-            for ioc in self.get_iocs("domains"):
-                if ioc["value"].lower() in url:
-                    self.log.warning("Maybe found a known suspicious domain %s matching indicators from \"%s\"",
-                                     url, ioc["name"])
-                    return True
-
-            # If nothing matched, we can quit here.
-            return False
-
-        # If all parsing worked, we start walking through available domain indicators.
-        for ioc in self.get_iocs("domains"):
-            # First we check the full domain.
-            if final_url.domain.lower() == ioc["value"]:
-                if orig_url.is_shortened and orig_url.url != final_url.url:
-                    self.log.warning("Found a known suspicious domain %s shortened as %s matching indicators from \"%s\"",
-                                     final_url.url, orig_url.url, ioc["name"])
-                else:
-                    self.log.warning("Found a known suspicious domain %s matching indicators from \"%s\"",
-                                     final_url.url, ioc["name"])
-
-                return True
-
-            # Then we just check the top level domain.
-            if final_url.top_level.lower() == ioc["value"]:
-                if orig_url.is_shortened and orig_url.url != final_url.url:
-                    self.log.warning("Found a sub-domain with suspicious top level %s shortened as %s matching indicators from \"%s\"",
-                                     final_url.url, orig_url.url, ioc["name"])
-                else:
-                    self.log.warning("Found a sub-domain with a suspicious top level %s matching indicators from \"%s\"",
-                                     final_url.url, ioc["name"])
-
-                return True
-
-        return False
-
-    def check_domains(self, urls) -> bool:
-        """Check a list of URLs against the provided list of domain indicators.
-
-        :param urls: List of URLs to check against domain indicators
-        :type urls: list
-        :returns: True if any URL matched an indicator, otherwise False
-        :rtype: bool
-
-        """
-        if not urls:
-            return False
-
-        for url in urls:
-            if self.check_domain(url):
-                return True
-
-        return False
-
-    def check_process(self, process) -> bool:
-        """Check the provided process name against the list of process
-        indicators.
-
-        :param process: Process name to check against process indicators
-        :type process: str
-        :returns: True if process matched an indicator, otherwise False
-        :rtype: bool
-
-        """
-        if not process:
-            return False
-
-        proc_name = os.path.basename(process)
-        for ioc in self.get_iocs("processes"):
-            if proc_name == ioc["value"]:
-                self.log.warning("Found a known suspicious process name \"%s\" matching indicators from \"%s\"",
-                                 process, ioc["name"])
-                return True
-
-            if len(proc_name) == 16:
-                if ioc["value"].startswith(proc_name):
-                    self.log.warning("Found a truncated known suspicious process name \"%s\" matching indicators from \"%s\"",
-                                     process, ioc["name"])
-                    return True
-
-        return False
-
-    def check_processes(self, processes) -> bool:
-        """Check the provided list of processes against the list of
-        process indicators.
-
-        :param processes: List of processes to check against process indicators
-        :type processes: list
-        :returns: True if process matched an indicator, otherwise False
-        :rtype: bool
-
-        """
-        if not processes:
-            return False
-
-        for process in processes:
-            if self.check_process(process):
-                return True
-
-        return False
-
-    def check_email(self, email) -> bool:
-        """Check the provided email against the list of email indicators.
-
-        :param email: Email address to check against email indicators
-        :type email: str
-        :returns: True if email address matched an indicator, otherwise False
-        :rtype: bool
-
-        """
-        if not email:
-            return False
-
-        for ioc in self.get_iocs("emails"):
-            if email.lower() == ioc["value"].lower():
-                self.log.warning("Found a known suspicious email address \"%s\" matching indicators from \"%s\"",
-                                 email, ioc["name"])
-                return True
-
-        return False
-
-    def check_file_name(self, file_name) -> bool:
-        """Check the provided file name against the list of file indicators.
-
-        :param file_name: File name to check against file
-        indicators
-        :type file_name: str
-        :returns: True if the file name matched an indicator, otherwise False
-        :rtype: bool
-
-        """
-        if not file_name:
-            return False
-
-        for ioc in self.get_iocs("file_names"):
-            if ioc["value"] == file_name:
-                self.log.warning("Found a known suspicious file name \"%s\" matching indicators from \"%s\"",
-                                 file_name, ioc["name"])
-                return True
-
-        return False
-
-    def check_file_path(self, file_path) -> bool:
-        """Check the provided file path against the list of file indicators (both path and name).
-
-        :param file_path: File path or file name to check against file
-        indicators
-        :type file_path: str
-        :returns: True if the file path matched an indicator, otherwise False
-        :rtype: bool
-
-        """
-        if not file_path:
-            return False
-
-        if self.check_file_name(os.path.basename(file_path)):
-            return True
-
-        for ioc in self.get_iocs("file_paths"):
-            # Strip any trailing slash from indicator paths to match directories.
-            if file_path.startswith(ioc["value"].rstrip("/")):
-                self.log.warning("Found a known suspicious file path \"%s\" matching indicators form \"%s\"",
-                                 file_path, ioc["name"])
-                return True
-
-        return False
-
-    def check_profile(self, profile_uuid) -> bool:
-        """Check the provided configuration profile UUID against the list of indicators.
-
-        :param profile_uuid: Profile UUID to check against configuration profile indicators
-        :type profile_uuid: str
-        :returns: True if the UUID in indicator list, otherwise False
-        :rtype: bool
-
-        """
-        for ioc in self.get_iocs("ios_profile_ids"):
-            if profile_uuid in ioc["value"]:
-                self.log.warning("Found a known suspicious profile ID \"%s\" matching indicators from \"%s\"",
-                                 profile_uuid, ioc["name"])
-                return True
-
-        return False
-
-
-def download_indicators_files(log):
-    """
-    Download indicators from repo into MVT app data directory.
-    """
-    data_dir = user_data_dir("mvt")
-    if not os.path.isdir(data_dir):
-        os.makedirs(data_dir, exist_ok=True)
-
-    # Download latest list of indicators from the MVT repo.
-    res = requests.get("https://github.com/mvt-project/mvt/raw/main/public_indicators.json")
-    if res.status_code != 200:
-        log.warning("Unable to find retrieve list of indicators from the MVT repository.")
-        return
-
-    for ioc_entry in res.json():
-        ioc_url = ioc_entry["stix2_url"]
-        log.info("Downloading indicator file '%s' from '%s'", ioc_entry["name"], ioc_url)
-
-        res = requests.get(ioc_url)
-        if res.status_code != 200:
-            log.warning("Could not find indicator file '%s'", ioc_url)
-            continue
-
-        clean_file_name = ioc_url.lstrip("https://").replace("/", "_")
-        ioc_path = os.path.join(data_dir, clean_file_name)
-
-        # Write file to disk. This will overwrite any older version of the STIX2 file.
-        with io.open(ioc_path, "w") as f:
-            f.write(res.text)
-
-        log.info("Saved indicator file to '%s'", os.path.basename(ioc_path))

mvt/common/logo.py

@@ -1,25 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from rich import print
-
-from .version import MVT_VERSION, check_for_updates
-
-
-def logo():
-    print("\n")
-    print("\t[bold]MVT[/bold] - Mobile Verification Toolkit")
-    print("\t\thttps://mvt.re")
-    print(f"\t\tVersion: {MVT_VERSION}")
-
-    try:
-        latest_version = check_for_updates()
-    except Exception:
-        pass
-    else:
-        if latest_version:
-            print(f"\t\t[bold]Version {latest_version} is available! Upgrade mvt![/bold]")
-
-    print("\n")

mvt/common/module.py

@@ -1,204 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import csv
-import io
-import os
-import re
-
-import simplejson as json
-
-
-class DatabaseNotFoundError(Exception):
-    pass
-
-
-class DatabaseCorruptedError(Exception):
-    pass
-
-
-class InsufficientPrivileges(Exception):
-    pass
-
-
-class MVTModule(object):
-    """This class provides a base for all extraction modules."""
-
-    enabled = True
-    slug = None
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=None):
-        """Initialize module.
-
-        :param file_path: Path to the module's database file, if there is any
-        :type file_path: str
-        :param base_folder: Path to the base folder (backup or filesystem dump)
-        :type file_path: str
-        :param output_folder: Folder where results will be stored
-        :type output_folder: str
-        :param fast_mode: Flag to enable or disable slow modules
-        :type fast_mode: bool
-        :param log: Handle to logger
-        :param results: Provided list of results entries
-        :type results: list
-        """
-        self.file_path = file_path
-        self.base_folder = base_folder
-        self.output_folder = output_folder
-        self.fast_mode = fast_mode
-        self.log = log
-        self.indicators = None
-        self.results = results if results else []
-        self.detected = []
-        self.timeline = []
-        self.timeline_detected = []
-
-    @classmethod
-    def from_json(cls, json_path, log=None):
-        with open(json_path, "r") as handle:
-            results = json.load(handle)
-            if log:
-                log.info("Loaded %d results from \"%s\"",
-                         len(results), json_path)
-            return cls(results=results, log=log)
-
-    def get_slug(self):
-        """Use the module's class name to retrieve a slug"""
-        if self.slug:
-            return self.slug
-
-        sub = re.sub("(.)([A-Z][a-z]+)", r"\1_\2", self.__class__.__name__)
-        return re.sub("([a-z0-9])([A-Z])", r"\1_\2", sub).lower()
-
-    def check_indicators(self):
-        """Check the results of this module against a provided list of
-        indicators.
-
-
-        """
-        raise NotImplementedError
-
-    def save_to_json(self):
-        """Save the collected results to a json file."""
-        if not self.output_folder:
-            return
-
-        name = self.get_slug()
-
-        if self.results:
-            results_file_name = f"{name}.json"
-            results_json_path = os.path.join(self.output_folder, results_file_name)
-            with io.open(results_json_path, "w", encoding="utf-8") as handle:
-                try:
-                    json.dump(self.results, handle, indent=4, default=str)
-                except Exception as e:
-                    self.log.error("Unable to store results of module %s to file %s: %s",
-                                   self.__class__.__name__, results_file_name, e)
-
-        if self.detected:
-            detected_file_name = f"{name}_detected.json"
-            detected_json_path = os.path.join(self.output_folder, detected_file_name)
-            with io.open(detected_json_path, "w", encoding="utf-8") as handle:
-                json.dump(self.detected, handle, indent=4, default=str)
-
-    def serialize(self, record):
-        raise NotImplementedError
-
-    @staticmethod
-    def _deduplicate_timeline(timeline):
-        """Serialize entry as JSON to deduplicate repeated entries
-
-        :param timeline: List of entries from timeline to deduplicate
-
-        """
-        timeline_set = set()
-        for record in timeline:
-            timeline_set.add(json.dumps(record, sort_keys=True))
-        return [json.loads(record) for record in timeline_set]
-
-    def to_timeline(self):
-        """Convert results into a timeline."""
-        for result in self.results:
-            record = self.serialize(result)
-            if record:
-                if type(record) == list:
-                    self.timeline.extend(record)
-                else:
-                    self.timeline.append(record)
-
-        for detected in self.detected:
-            record = self.serialize(detected)
-            if record:
-                if type(record) == list:
-                    self.timeline_detected.extend(record)
-                else:
-                    self.timeline_detected.append(record)
-
-        # De-duplicate timeline entries.
-        self.timeline = self._deduplicate_timeline(self.timeline)
-        self.timeline_detected = self._deduplicate_timeline(self.timeline_detected)
-
-    def run(self):
-        """Run the main module procedure."""
-        raise NotImplementedError
-
-
-def run_module(module):
-    module.log.info("Running module %s...", module.__class__.__name__)
-
-    try:
-        module.run()
-    except NotImplementedError:
-        module.log.exception("The run() procedure of module %s was not implemented yet!",
-                             module.__class__.__name__)
-    except InsufficientPrivileges as e:
-        module.log.info("Insufficient privileges for module %s: %s", module.__class__.__name__, e)
-    except DatabaseNotFoundError as e:
-        module.log.info("There might be no data to extract by module %s: %s",
-                        module.__class__.__name__, e)
-    except DatabaseCorruptedError as e:
-        module.log.error("The %s module database seems to be corrupted: %s",
-                         module.__class__.__name__, e)
-    except Exception as e:
-        module.log.exception("Error in running extraction from module %s: %s",
-                             module.__class__.__name__, e)
-    else:
-        try:
-            module.check_indicators()
-        except NotImplementedError:
-            module.log.info("The %s module does not support checking for indicators",
-                            module.__class__.__name__)
-            pass
-        else:
-            if module.indicators and not module.detected:
-                module.log.info("The %s module produced no detections!",
-                                module.__class__.__name__)
-
-        try:
-            module.to_timeline()
-        except NotImplementedError:
-            pass
-
-        module.save_to_json()
-
-
-def save_timeline(timeline, timeline_path):
-    """Save the timeline in a csv file.
-
-    :param timeline: List of records to order and store
-    :param timeline_path: Path to the csv file to store the timeline to
-
-    """
-    with io.open(timeline_path, "a+", encoding="utf-8") as handle:
-        csvoutput = csv.writer(handle, delimiter=",", quotechar="\"")
-        csvoutput.writerow(["UTC Timestamp", "Plugin", "Event", "Description"])
-        for event in sorted(timeline, key=lambda x: x["timestamp"] if x["timestamp"] is not None else ""):
-            csvoutput.writerow([
-                event.get("timestamp"),
-                event.get("module"),
-                event.get("event"),
-                event.get("data"),
-            ])

mvt/common/utils.py

@@ -1,121 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import datetime
-import hashlib
-import re
-
-
-def convert_mactime_to_unix(timestamp, from_2001=True):
-    """Converts Mac Standard Time to a Unix timestamp.
-
-    :param timestamp: MacTime timestamp (either int or float).
-    :type timestamp: int
-    :param from_2001: bool: Whether to (Default value = True)
-    :param from_2001: Default value = True)
-    :returns: Unix epoch timestamp.
-
-    """
-    if not timestamp:
-        return None
-
-    # This is to fix formats in case of, for example, SMS messages database
-    # timestamp format.
-    if type(timestamp) == int and len(str(timestamp)) == 18:
-        timestamp = int(str(timestamp)[:9])
-
-    # MacTime counts from 2001-01-01.
-    if from_2001:
-        timestamp = timestamp + 978307200
-
-    # TODO: This is rather ugly. Happens sometimes with invalid timestamps.
-    try:
-        return datetime.datetime.utcfromtimestamp(timestamp)
-    except Exception:
-        return None
-
-
-def convert_chrometime_to_unix(timestamp):
-    """Converts Chrome timestamp to a Unix timestamp.
-
-    :param timestamp: Chrome timestamp as int.
-    :type timestamp: int
-    :returns: Unix epoch timestamp.
-
-    """
-    epoch_start = datetime.datetime(1601, 1, 1)
-    delta = datetime.timedelta(microseconds=timestamp)
-    return epoch_start + delta
-
-
-def convert_timestamp_to_iso(timestamp):
-    """Converts Unix timestamp to ISO string.
-
-    :param timestamp: Unix timestamp.
-    :type timestamp: int
-    :returns: ISO timestamp string in YYYY-mm-dd HH:MM:SS.ms format.
-    :rtype: str
-
-    """
-    try:
-        return timestamp.strftime("%Y-%m-%d %H:%M:%S.%f")
-    except Exception:
-        return None
-
-
-def check_for_links(text):
-    """Checks if a given text contains HTTP links.
-
-    :param text: Any provided text.
-    :type text: str
-    :returns: Search results.
-
-    """
-    return re.findall("(?P<url>https?://[^\s]+)", text, re.IGNORECASE)
-
-
-def get_sha256_from_file_path(file_path):
-    """Calculate the SHA256 hash of a file from a file path.
-
-    :param file_path: Path to the file to hash
-    :returns: The SHA256 hash string
-
-    """
-    sha256_hash = hashlib.sha256()
-    with open(file_path, "rb") as handle:
-        for byte_block in iter(lambda: handle.read(4096), b""):
-            sha256_hash.update(byte_block)
-
-    return sha256_hash.hexdigest()
-
-
-# Note: taken from here:
-# https://stackoverflow.com/questions/57014259/json-dumps-on-dictionary-with-bytes-for-keys
-def keys_bytes_to_string(obj):
-    """Convert object keys from bytes to string.
-
-    :param obj: Object to convert from bytes to string.
-    :returns: Object converted to string.
-    :rtype: str
-
-    """
-    new_obj = {}
-    if not isinstance(obj, dict):
-        if isinstance(obj, (tuple, list, set)):
-            value = [keys_bytes_to_string(x) for x in obj]
-            return value
-        else:
-            return obj
-
-    for key, value in obj.items():
-        if isinstance(key, bytes):
-            key = key.decode()
-        if isinstance(value, dict):
-            value = keys_bytes_to_string(value)
-        elif isinstance(value, (tuple, list, set)):
-            value = [keys_bytes_to_string(x) for x in value]
-        new_obj[key] = value
-
-    return new_obj

mvt/common/version.py

@@ -1,20 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import requests
-from packaging import version
-
-MVT_VERSION = "1.4.6"
-
-
-def check_for_updates():
-    res = requests.get("https://pypi.org/pypi/mvt/json")
-    data = res.json()
-    latest_version = data.get("info", {}).get("version", "")
-
-    if version.parse(latest_version) > version.parse(MVT_VERSION):
-        return latest_version
-
-    return None

mvt/ios/cli.py

@@ -1,316 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-import click
-from rich.logging import RichHandler
-from rich.prompt import Prompt
-
-from mvt.common.help import (HELP_MSG_FAST, HELP_MSG_IOC,
-                             HELP_MSG_LIST_MODULES, HELP_MSG_MODULE,
-                             HELP_MSG_OUTPUT)
-from mvt.common.indicators import Indicators, download_indicators_files
-from mvt.common.logo import logo
-from mvt.common.module import run_module, save_timeline
-from mvt.common.options import MutuallyExclusiveOption
-
-from .decrypt import DecryptBackup
-from .modules.backup import BACKUP_MODULES
-from .modules.fs import FS_MODULES
-from .modules.mixed import MIXED_MODULES
-
-# Setup logging using Rich.
-LOG_FORMAT = "[%(name)s] %(message)s"
-logging.basicConfig(level="INFO", format=LOG_FORMAT, handlers=[
-    RichHandler(show_path=False, log_time_format="%X")])
-log = logging.getLogger(__name__)
-
-# Set this environment variable to a password if needed.
-PASSWD_ENV = "MVT_IOS_BACKUP_PASSWORD"
-
-
-#==============================================================================
-# Main
-#==============================================================================
-@click.group(invoke_without_command=False)
-def cli():
-    logo()
-
-
-#==============================================================================
-# Command: version
-#==============================================================================
-@cli.command("version", help="Show the currently installed version of MVT")
-def version():
-    return
-
-
-#==============================================================================
-# Command: decrypt-backup
-#==============================================================================
-@cli.command("decrypt-backup", help="Decrypt an encrypted iTunes backup")
-@click.option("--destination", "-d", required=True,
-              help="Path to the folder where to store the decrypted backup")
-@click.option("--password", "-p", cls=MutuallyExclusiveOption,
-              help=f"Password to use to decrypt the backup (or, set {PASSWD_ENV} environment variable)",
-              mutually_exclusive=["key_file"])
-@click.option("--key-file", "-k", cls=MutuallyExclusiveOption,
-              type=click.Path(exists=True),
-              help="File containing raw encryption key to use to decrypt the backup",
-              mutually_exclusive=["password"])
-@click.argument("BACKUP_PATH", type=click.Path(exists=True))
-@click.pass_context
-def decrypt_backup(ctx, destination, password, key_file, backup_path):
-    backup = DecryptBackup(backup_path, destination)
-
-    if key_file:
-        if PASSWD_ENV in os.environ:
-            log.info("Ignoring environment variable, using --key-file '%s' instead",
-                     PASSWD_ENV, key_file)
-
-        backup.decrypt_with_key_file(key_file)
-    elif password:
-        log.info("Your password may be visible in the process table because it was supplied on the command line!")
-
-        if PASSWD_ENV in os.environ:
-            log.info("Ignoring %s environment variable, using --password argument instead",
-                     PASSWD_ENV)
-
-        backup.decrypt_with_password(password)
-    elif PASSWD_ENV in os.environ:
-        log.info("Using password from %s environment variable", PASSWD_ENV)
-        backup.decrypt_with_password(os.environ[PASSWD_ENV])
-    else:
-        sekrit = Prompt.ask("Enter backup password", password=True)
-        backup.decrypt_with_password(sekrit)
-
-    if not backup.can_process():
-        ctx.exit(1)
-
-    backup.process_backup()
-
-
-#==============================================================================
-# Command: extract-key
-#==============================================================================
-@cli.command("extract-key", help="Extract decryption key from an iTunes backup")
-@click.option("--password", "-p",
-              help=f"Password to use to decrypt the backup (or, set {PASSWD_ENV} environment variable)")
-@click.option("--key-file", "-k",
-              help="Key file to be written (if unset, will print to STDOUT)",
-              required=False,
-              type=click.Path(exists=False, file_okay=True, dir_okay=False, writable=True))
-@click.argument("BACKUP_PATH", type=click.Path(exists=True))
-def extract_key(password, backup_path, key_file):
-    backup = DecryptBackup(backup_path)
-
-    if password:
-        log.info("Your password may be visible in the process table because it was supplied on the command line!")
-
-        if PASSWD_ENV in os.environ:
-            log.info("Ignoring %s environment variable, using --password argument instead",
-                     PASSWD_ENV)
-    elif PASSWD_ENV in os.environ:
-        log.info("Using password from %s environment variable", PASSWD_ENV)
-        password = os.environ[PASSWD_ENV]
-    else:
-        password = Prompt.ask("Enter backup password", password=True)
-
-    backup.decrypt_with_password(password)
-    backup.get_key()
-
-    if key_file:
-        backup.write_key(key_file)
-
-
-#==============================================================================
-# Command: check-backup
-#==============================================================================
-@cli.command("check-backup", help="Extract artifacts from an iTunes backup")
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
-@click.option("--fast", "-f", is_flag=True, help=HELP_MSG_FAST)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.argument("BACKUP_PATH", type=click.Path(exists=True))
-@click.pass_context
-def check_backup(ctx, iocs, output, fast, backup_path, list_modules, module):
-    if list_modules:
-        log.info("Following is the list of available check-backup modules:")
-        for backup_module in BACKUP_MODULES + MIXED_MODULES:
-            log.info(" - %s", backup_module.__name__)
-
-        return
-
-    log.info("Checking iTunes backup located at: %s", backup_path)
-
-    if output and not os.path.exists(output):
-        try:
-            os.makedirs(output)
-        except Exception as e:
-            log.critical("Unable to create output folder %s: %s", output, e)
-            ctx.exit(1)
-
-    indicators = Indicators(log=log)
-    indicators.load_indicators_files(iocs)
-
-    timeline = []
-    timeline_detected = []
-    for backup_module in BACKUP_MODULES + MIXED_MODULES:
-        if module and backup_module.__name__ != module:
-            continue
-
-        m = backup_module(base_folder=backup_path, output_folder=output, fast_mode=fast,
-                          log=logging.getLogger(backup_module.__module__))
-        m.is_backup = True
-        if indicators.total_ioc_count > 0:
-            m.indicators = indicators
-            m.indicators.log = m.log
-
-        run_module(m)
-        timeline.extend(m.timeline)
-        timeline_detected.extend(m.timeline_detected)
-
-    if output:
-        if len(timeline) > 0:
-            save_timeline(timeline, os.path.join(output, "timeline.csv"))
-        if len(timeline_detected) > 0:
-            save_timeline(timeline_detected, os.path.join(output, "timeline_detected.csv"))
-
-    if len(timeline_detected) > 0:
-        log.warning("The analysis of the backup produced %d detections!",
-                len(timeline_detected))
-
-
-#==============================================================================
-# Command: check-fs
-#==============================================================================
-@cli.command("check-fs", help="Extract artifacts from a full filesystem dump")
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
-@click.option("--fast", "-f", is_flag=True, help=HELP_MSG_FAST)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.argument("DUMP_PATH", type=click.Path(exists=True))
-@click.pass_context
-def check_fs(ctx, iocs, output, fast, dump_path, list_modules, module):
-    if list_modules:
-        log.info("Following is the list of available check-fs modules:")
-        for fs_module in FS_MODULES + MIXED_MODULES:
-            log.info(" - %s", fs_module.__name__)
-
-        return
-
-    log.info("Checking filesystem dump located at: %s", dump_path)
-
-    if output and not os.path.exists(output):
-        try:
-            os.makedirs(output)
-        except Exception as e:
-            log.critical("Unable to create output folder %s: %s", output, e)
-            ctx.exit(1)
-
-    indicators = Indicators(log=log)
-    indicators.load_indicators_files(iocs)
-
-    timeline = []
-    timeline_detected = []
-    for fs_module in FS_MODULES + MIXED_MODULES:
-        if module and fs_module.__name__ != module:
-            continue
-
-        m = fs_module(base_folder=dump_path, output_folder=output, fast_mode=fast,
-                      log=logging.getLogger(fs_module.__module__))
-
-        m.is_fs_dump = True
-        if indicators.total_ioc_count > 0:
-            m.indicators = indicators
-            m.indicators.log = m.log
-
-        run_module(m)
-        timeline.extend(m.timeline)
-        timeline_detected.extend(m.timeline_detected)
-
-    if output:
-        if len(timeline) > 0:
-            save_timeline(timeline, os.path.join(output, "timeline.csv"))
-        if len(timeline_detected) > 0:
-            save_timeline(timeline_detected, os.path.join(output, "timeline_detected.csv"))
-
-    if len(timeline_detected) > 0:
-        log.warning("The analysis of the filesystem produced %d detections!",
-                    len(timeline_detected))
-
-#==============================================================================
-# Command: check-iocs
-#==============================================================================
-@cli.command("check-iocs", help="Compare stored JSON results to provided indicators")
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.argument("FOLDER", type=click.Path(exists=True))
-@click.pass_context
-def check_iocs(ctx, iocs, list_modules, module, folder):
-    all_modules = []
-    for entry in BACKUP_MODULES + FS_MODULES + MIXED_MODULES:
-        if entry not in all_modules:
-            all_modules.append(entry)
-
-    if list_modules:
-        log.info("Following is the list of available check-iocs modules:")
-        for iocs_module in all_modules:
-            log.info(" - %s", iocs_module.__name__)
-
-        return
-
-    log.info("Checking stored results against provided indicators...")
-
-    indicators = Indicators(log=log)
-    indicators.load_indicators_files(iocs)
-
-    total_detections = 0
-    for file_name in os.listdir(folder):
-        name_only, ext = os.path.splitext(file_name)
-        file_path = os.path.join(folder, file_name)
-
-        for iocs_module in all_modules:
-            if module and iocs_module.__name__ != module:
-                continue
-
-            if iocs_module().get_slug() != name_only:
-                continue
-
-            log.info("Loading results from \"%s\" with module %s", file_name,
-                     iocs_module.__name__)
-
-            m = iocs_module.from_json(file_path,
-                                      log=logging.getLogger(iocs_module.__module__))
-            if indicators.total_ioc_count > 0:
-                m.indicators = indicators
-                m.indicators.log = m.log
-
-            try:
-                m.check_indicators()
-            except NotImplementedError:
-                continue
-            else:
-                total_detections += len(m.detected)
-
-    if total_detections > 0:
-        log.warning("The check of the results produced %d detections!",
-                    total_detections)
-
-
-#==============================================================================
-# Command: download-iocs
-#==============================================================================
-@cli.command("download-iocs", help="Download public STIX2 indicators")
-def download_iocs():
-    download_indicators_files(log)

mvt/ios/modules/__init__.py

@@ -1,4 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/

mvt/ios/modules/backup/backup_info.py

@@ -1,43 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import plistlib
-
-from mvt.common.module import DatabaseNotFoundError
-
-from ..base import IOSExtraction
-
-
-class BackupInfo(IOSExtraction):
-    """This module extracts information about the device and the backup."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = {}
-
-    def run(self):
-        info_path = os.path.join(self.base_folder, "Info.plist")
-        if not os.path.exists(info_path):
-            raise DatabaseNotFoundError("No Info.plist at backup path, unable to extract device information")
-
-        with open(info_path, "rb") as handle:
-            info = plistlib.load(handle)
-
-        fields = ["Build Version", "Device Name", "Display Name",
-                  "GUID", "ICCID", "IMEI", "MEID", "Installed Applications",
-                  "Last Backup Date", "Phone Number", "Product Name",
-                  "Product Type", "Product Version", "Serial Number",
-                  "Target Identifier", "Target Type", "Unique Identifier",
-                  "iTunes Version"]
-
-        for field in fields:
-            value = info.get(field, None)
-            self.log.info("%s: %s", field, value)
-            self.results[field] = value

mvt/ios/modules/backup/configuration_profiles.py

@@ -1,96 +0,0 @@
-
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import plistlib
-from base64 import b64encode
-
-from mvt.common.utils import convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-CONF_PROFILES_DOMAIN = "SysSharedContainerDomain-systemgroup.com.apple.configurationprofiles"
-
-
-class ConfigurationProfiles(IOSExtraction):
-    """This module extracts the full plist data from configuration profiles."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        if not record["install_date"]:
-            return
-
-        payload_name = record['plist'].get('PayloadDisplayName')
-        payload_description = record['plist'].get('PayloadDescription')
-        return {
-            "timestamp": record["install_date"],
-            "module": self.__class__.__name__,
-            "event": "configuration_profile_install",
-            "data": f"{record['plist']['PayloadType']} installed: {record['plist']['PayloadUUID']} - {payload_name}: {payload_description}"
-        }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if result["plist"].get("PayloadUUID"):
-                payload_content = result["plist"]["PayloadContent"][0]
-
-                # Alert on any known malicious configuration profiles in the indicator list.
-                if self.indicators.check_profile(result["plist"]["PayloadUUID"]):
-                    self.log.warning(f"Found a known malicious configuration profile \"{result['plist']['PayloadDisplayName']}\" with UUID '{result['plist']['PayloadUUID']}'.")
-                    self.detected.append(result)
-                    continue
-
-                # Highlight suspicious configuration profiles which may be used to hide notifications.
-                if payload_content["PayloadType"] in ["com.apple.notificationsettings"]:
-                    self.log.warning(f"Found a potentially suspicious configuration profile \"{result['plist']['PayloadDisplayName']}\" with payload type '{payload_content['PayloadType']}'.")
-                    self.detected.append(result)
-                    continue
-
-    def run(self):
-        for conf_file in self._get_backup_files_from_manifest(domain=CONF_PROFILES_DOMAIN):
-            conf_rel_path = conf_file["relative_path"]
-            # Filter out all configuration files that are not configuration profiles.
-            if not conf_rel_path or not os.path.basename(conf_rel_path).startswith("profile-"):
-                continue
-
-            conf_file_path = self._get_backup_file_from_id(conf_file["file_id"])
-            if not conf_file_path:
-                continue
-
-            with open(conf_file_path, "rb") as handle:
-                try:
-                    conf_plist = plistlib.load(handle)
-                except Exception:
-                    conf_plist = {}
-
-            if "SignerCerts" in conf_plist:
-                conf_plist["SignerCerts"] = [b64encode(x) for x in conf_plist["SignerCerts"]]
-            if "PushTokenDataSentToServerKey" in conf_plist:
-                conf_plist["PushTokenDataSentToServerKey"] = b64encode(conf_plist["PushTokenDataSentToServerKey"])
-            if "LastPushTokenHash" in conf_plist:
-                conf_plist["LastPushTokenHash"] = b64encode(conf_plist["LastPushTokenHash"])
-            if "PayloadContent" in conf_plist:
-                for x in range(len(conf_plist["PayloadContent"])):
-                    if "PERSISTENT_REF" in conf_plist["PayloadContent"][x]:
-                        conf_plist["PayloadContent"][x]["PERSISTENT_REF"] = b64encode(conf_plist["PayloadContent"][x]["PERSISTENT_REF"])
-
-            self.results.append({
-                "file_id": conf_file["file_id"],
-                "relative_path": conf_file["relative_path"],
-                "domain": conf_file["domain"],
-                "plist": conf_plist,
-                "install_date": convert_timestamp_to_iso(conf_plist.get("InstallDate")),
-            })
-
-        self.log.info("Extracted details about %d configuration profiles", len(self.results))

mvt/ios/modules/backup/manifest.py

@@ -1,143 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import datetime
-import io
-import os
-import plistlib
-import sqlite3
-
-from mvt.common.module import DatabaseNotFoundError
-from mvt.common.utils import convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-
-class Manifest(IOSExtraction):
-    """This module extracts information from a backup Manifest.db file."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def _get_key(self, dictionary, key):
-        """Unserialized plist objects can have keys which are str or byte types
-        This is a helper to try fetch a key as both a byte or string type.
-
-        :param dictionary:
-        :param key:
-
-        """
-        return dictionary.get(key.encode("utf-8"), None) or dictionary.get(key, None)
-
-    @staticmethod
-    def _convert_timestamp(timestamp_or_unix_time_int):
-        """Older iOS versions stored the manifest times as unix timestamps.
-
-        :param timestamp_or_unix_time_int:
-
-        """
-        if isinstance(timestamp_or_unix_time_int, datetime.datetime):
-            return convert_timestamp_to_iso(timestamp_or_unix_time_int)
-        else:
-            timestamp = datetime.datetime.utcfromtimestamp(timestamp_or_unix_time_int)
-            return convert_timestamp_to_iso(timestamp)
-
-    def serialize(self, record):
-        records = []
-        if "modified" not in record or "status_changed" not in record:
-            return
-        for ts in set([record["created"], record["modified"], record["status_changed"]]):
-            macb = ""
-            macb += "M" if ts == record["modified"] else "-"
-            macb += "-"
-            macb += "C" if ts == record["status_changed"] else "-"
-            macb += "B" if ts == record["created"] else "-"
-
-            records.append({
-                "timestamp": ts,
-                "module": self.__class__.__name__,
-                "event": macb,
-                "data": f"{record['relative_path']} - {record['domain']}"
-            })
-
-        return records
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if not result.get("relative_path"):
-                continue
-
-            if result["domain"]:
-                if os.path.basename(result["relative_path"]) == "com.apple.CrashReporter.plist" and result["domain"] == "RootDomain":
-                    self.log.warning("Found a potentially suspicious \"com.apple.CrashReporter.plist\" file created in RootDomain")
-                    self.detected.append(result)
-                    continue
-
-            if self.indicators.check_file_path("/" + result["relative_path"]):
-                self.detected.append(result)
-                continue
-
-            rel_path = result["relative_path"].lower()
-            for ioc in self.indicators.get_iocs("domains"):
-                if ioc["value"].lower() in rel_path:
-                    self.log.warning("Found mention of domain \"%s\" in a backup file with path: %s",
-                                     ioc["value"], rel_path)
-                    self.detected.append(result)
-
-    def run(self):
-        manifest_db_path = os.path.join(self.base_folder, "Manifest.db")
-        if not os.path.isfile(manifest_db_path):
-            raise DatabaseNotFoundError("unable to find backup's Manifest.db")
-
-        self.log.info("Found Manifest.db database at path: %s", manifest_db_path)
-
-        conn = sqlite3.connect(manifest_db_path)
-        cur = conn.cursor()
-
-        cur.execute("SELECT * FROM Files;")
-        names = [description[0] for description in cur.description]
-
-        for file_entry in cur:
-            file_data = {}
-            for index, value in enumerate(file_entry):
-                file_data[names[index]] = value
-
-            cleaned_metadata = {
-                "file_id": file_data["fileID"],
-                "domain": file_data["domain"],
-                "relative_path": file_data["relativePath"],
-                "flags": file_data["flags"],
-                "created": "",
-            }
-
-            if file_data["file"]:
-                try:
-                    file_plist = plistlib.load(io.BytesIO(file_data["file"]))
-                    file_metadata = self._get_key(file_plist, "$objects")[1]
-                    cleaned_metadata.update({
-                        "created": self._convert_timestamp(self._get_key(file_metadata, "Birth")),
-                        "modified": self._convert_timestamp(self._get_key(file_metadata, "LastModified")),
-                        "status_changed": self._convert_timestamp(self._get_key(file_metadata, "LastStatusChange")),
-                        "mode": oct(self._get_key(file_metadata, "Mode")),
-                        "owner": self._get_key(file_metadata, "UserID"),
-                        "size": self._get_key(file_metadata, "Size"),
-                    })
-                except Exception:
-                    self.log.exception("Error reading manifest file metadata for file with ID %s and relative path %s",
-                                       file_data["fileID"], file_data["relativePath"])
-                    pass
-
-            self.results.append(cleaned_metadata)
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d file metadata items", len(self.results))

mvt/ios/modules/backup/profile_events.py

@@ -1,61 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import plistlib
-
-from mvt.common.utils import convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-CONF_PROFILES_EVENTS_RELPATH = "Library/ConfigurationProfiles/MCProfileEvents.plist"
-
-
-class ProfileEvents(IOSExtraction):
-    """This module extracts events related to the installation of configuration
-    profiles.
-
-
-    """
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        return {
-            "timestamp": record.get("timestamp"),
-            "module": self.__class__.__name__,
-            "event": "profile_operation",
-            "data": f"Process {record.get('process')} started operation {record.get('operation')} of profile {record.get('profile_id')}"
-        }
-
-    def run(self):
-        for events_file in self._get_backup_files_from_manifest(relative_path=CONF_PROFILES_EVENTS_RELPATH):
-            events_file_path = self._get_backup_file_from_id(events_file["file_id"])
-            if not events_file_path:
-                continue
-
-            with open(events_file_path, "rb") as handle:
-                events_plist = plistlib.load(handle)
-
-            if "ProfileEvents" not in events_plist:
-                continue
-
-            for event in events_plist["ProfileEvents"]:
-                key = list(event.keys())[0]
-                self.log.info("On %s process \"%s\" started operation \"%s\" of profile \"%s\"",
-                              event[key].get("timestamp"), event[key].get("process"),
-                              event[key].get("operation"), key)
-
-                self.results.append({
-                    "profile_id": key,
-                    "timestamp": convert_timestamp_to_iso(event[key].get("timestamp")),
-                    "operation": event[key].get("operation"),
-                    "process": event[key].get("process"),
-                })
-
-        self.log.info("Extracted %d profile events", len(self.results))

mvt/ios/modules/base.py

@@ -1,157 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import glob
-import os
-import shutil
-import sqlite3
-import subprocess
-
-from mvt.common.module import (DatabaseCorruptedError, DatabaseNotFoundError,
-                               MVTModule)
-
-
-class IOSExtraction(MVTModule):
-    """This class provides a base for all iOS filesystem/backup extraction modules."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.is_backup = False
-        self.is_fs_dump = False
-        self.is_sysdiagnose = False
-
-    def _recover_sqlite_db_if_needed(self, file_path, forced=False):
-        """Tries to recover a malformed database by running a .clone command.
-
-        :param file_path: Path to the malformed database file.
-
-        """
-        # TODO: Find a better solution.
-        if not forced:
-            conn = sqlite3.connect(file_path)
-            cur = conn.cursor()
-
-            try:
-                recover = False
-                cur.execute("SELECT name FROM sqlite_master WHERE type='table';")
-            except sqlite3.DatabaseError as e:
-                if "database disk image is malformed" in str(e):
-                    recover = True
-            finally:
-                conn.close()
-
-            if not recover:
-                return
-
-        self.log.info("Database at path %s is malformed. Trying to recover...", file_path)
-
-        if not shutil.which("sqlite3"):
-            raise DatabaseCorruptedError("failed to recover without sqlite3 binary: please install sqlite3!")
-        if '"' in file_path:
-            raise DatabaseCorruptedError(f"database at path '{file_path}' is corrupted. unable to recover because it has a quotation mark (\") in its name")
-
-        bak_path = f"{file_path}.bak"
-        shutil.move(file_path, bak_path)
-
-        ret = subprocess.call(["sqlite3", bak_path, f".clone \"{file_path}\""],
-                              stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-        if ret != 0:
-            raise DatabaseCorruptedError("failed to recover database")
-
-        self.log.info("Database at path %s recovered successfully!", file_path)
-
-    def _get_backup_files_from_manifest(self, relative_path=None, domain=None):
-        """Locate files from Manifest.db.
-
-        :param relative_path: Relative path to use as filter from Manifest.db. (Default value = None)
-        :param domain: Domain to use as filter from Manifest.db. (Default value = None)
-
-        """
-        manifest_db_path = os.path.join(self.base_folder, "Manifest.db")
-        if not os.path.exists(manifest_db_path):
-            raise DatabaseNotFoundError("unable to find backup's Manifest.db")
-
-        base_sql = "SELECT fileID, domain, relativePath FROM Files WHERE "
-
-        try:
-            conn = sqlite3.connect(manifest_db_path)
-            cur = conn.cursor()
-            if relative_path and domain:
-                cur.execute(f"{base_sql} relativePath = ? AND domain = ?;",
-                            (relative_path, domain))
-            else:
-                if relative_path:
-                    cur.execute(f"{base_sql} relativePath = ?;", (relative_path,))
-                elif domain:
-                    cur.execute(f"{base_sql} domain = ?;", (domain,))
-        except Exception as e:
-            raise DatabaseCorruptedError("failed to query Manifest.db: %s", e)
-
-        for row in cur:
-            yield {
-                "file_id": row[0],
-                "domain": row[1],
-                "relative_path": row[2],
-            }
-
-    def _get_backup_file_from_id(self, file_id):
-        file_path = os.path.join(self.base_folder, file_id[0:2], file_id)
-        if os.path.exists(file_path):
-            return file_path
-
-        return None
-
-    def _get_fs_files_from_patterns(self, root_paths):
-        for root_path in root_paths:
-            for found_path in glob.glob(os.path.join(self.base_folder, root_path)):
-                if not os.path.exists(found_path):
-                    continue
-
-                yield found_path
-
-    def _find_ios_database(self, backup_ids=None, root_paths=[]):
-        """Try to locate a module's database file from either an iTunes
-        backup or a full filesystem dump. This is intended only for
-        modules that expect to work with a single SQLite database.
-        If a module requires to process multiple databases or files,
-        you should use the helper functions above.
-
-        :param backup_id: iTunes backup database file's ID (or hash).
-        :param root_paths: Glob patterns for files to seek in filesystem dump. (Default value = [])
-        :param backup_ids: Default value = None)
-
-        """
-        file_path = None
-        # First we check if the was an explicit file path specified.
-        if not self.file_path:
-            # If not, we first try with backups.
-            # We construct the path to the file according to the iTunes backup
-            # folder structure, if we have a valid ID.
-            if backup_ids:
-                for backup_id in backup_ids:
-                    file_path = self._get_backup_file_from_id(backup_id)
-                    if file_path:
-                        break
-
-            # If this file does not exist we might be processing a full
-            # filesystem dump (checkra1n all the things!).
-            if not file_path or not os.path.exists(file_path):
-                # We reset the file_path.
-                file_path = None
-                for found_path in self._get_fs_files_from_patterns(root_paths):
-                    file_path = found_path
-                    break
-
-        # If we do not find any, we fail.
-        if file_path:
-            self.file_path = file_path
-        else:
-            raise DatabaseNotFoundError("unable to find the module's database file")
-
-        self._recover_sqlite_db_if_needed(self.file_path)

mvt/ios/modules/fs/analytics.py

@@ -1,120 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import plistlib
-import sqlite3
-
-from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-ANALYTICS_DB_PATH = [
-    "private/var/Keychains/Analytics/*.db",
-]
-
-
-class Analytics(IOSExtraction):
-    """This module extracts information from the private/var/Keychains/Analytics/*.db files."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        return {
-            "timestamp": record["timestamp"],
-            "module": self.__class__.__name__,
-            "event": record["artifact"],
-            "data": f"{record}",
-        }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            for value in result.values():
-                if not isinstance(value, str):
-                    continue
-
-                if self.indicators.check_process(value):
-                    self.log.warning("Found mention of a malicious process \"%s\" in %s file at %s",
-                                     value, result["artifact"], result["timestamp"])
-                    self.detected.append(result)
-                    continue
-
-                if self.indicators.check_domain(value):
-                    self.log.warning("Found mention of a malicious domain \"%s\" in %s file at %s",
-                                     value, result["artifact"], result["timestamp"])
-                    self.detected.append(result)
-
-    def _extract_analytics_data(self):
-        artifact = self.file_path.split("/")[-1]
-
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-
-        try:
-            cur.execute("""
-                SELECT
-                    timestamp,
-                    data
-                FROM hard_failures
-                UNION
-                SELECT
-                    timestamp,
-                    data
-                FROM soft_failures
-                UNION
-                SELECT
-                    timestamp,
-                    data
-                FROM all_events;
-            """)
-        except sqlite3.OperationalError:
-            cur.execute("""
-                SELECT
-                    timestamp,
-                    data
-                FROM hard_failures
-                UNION
-                SELECT
-                    timestamp,
-                    data
-                FROM soft_failures;
-            """)
-
-        for row in cur:
-            if row[0] and row[1]:
-                timestamp = convert_timestamp_to_iso(convert_mactime_to_unix(row[0], False))
-                data = plistlib.loads(row[1])
-                data["timestamp"] = timestamp
-            elif row[0]:
-                timestamp = convert_timestamp_to_iso(convert_mactime_to_unix(row[0], False))
-                data = {}
-                data["timestamp"] = timestamp
-            elif row[1]:
-                timestamp = ""
-                data = plistlib.loads(row[1])
-                data["timestamp"] = timestamp
-
-            data["artifact"] = artifact
-
-            self.results.append(data)
-
-        self.results = sorted(self.results, key=lambda entry: entry["timestamp"])
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted information on %d analytics data from %s", len(self.results), artifact)
-
-    def run(self):
-        for file_path in self._get_fs_files_from_patterns(ANALYTICS_DB_PATH):
-            self.file_path = file_path
-            self.log.info("Found Analytics database file at path: %s", file_path)
-            self._extract_analytics_data()

mvt/ios/modules/fs/cache_files.py

@@ -1,78 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import sqlite3
-
-from ..base import IOSExtraction
-
-
-class CacheFiles(IOSExtraction):
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        records = []
-        for item in self.results[record]:
-            records.append({
-                "timestamp": item["isodate"],
-                "module": self.__class__.__name__,
-                "event": "cache_response",
-                "data": f"{record} recorded visit to URL {item['url']}"
-            })
-
-        return records
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        self.detected = {}
-        for key, values in self.results.items():
-            for value in values:
-                if self.indicators.check_domain(value["url"]):
-                    if key not in self.detected:
-                        self.detected[key] = [value, ]
-                    else:
-                        self.detected[key].append(value)
-
-    def _process_cache_file(self, file_path):
-        self.log.info("Processing cache file at path: %s", file_path)
-
-        conn = sqlite3.connect(file_path)
-        cur = conn.cursor()
-
-        try:
-            cur.execute("SELECT * FROM cfurl_cache_response;")
-        except sqlite3.OperationalError:
-            return
-
-        key_name = os.path.relpath(file_path, self.base_folder)
-        if key_name not in self.results:
-            self.results[key_name] = []
-
-        for row in cur:
-            self.results[key_name].append({
-                "entry_id": row[0],
-                "version": row[1],
-                "hash_value": row[2],
-                "storage_policy": row[3],
-                "url": row[4],
-                "isodate": row[5],
-            })
-
-    def run(self):
-        self.results = {}
-        for root, dirs, files in os.walk(self.base_folder):
-            for file_name in files:
-                if file_name != "Cache.db":
-                    continue
-
-                file_path = os.path.join(root, file_name)
-                self._process_cache_file(file_path)

mvt/ios/modules/fs/net_netusage.py

@@ -1,39 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import sqlite3
-
-from ..net_base import NetBase
-
-NETUSAGE_ROOT_PATHS = [
-    "private/var/networkd/netusage.sqlite",
-    "private/var/networkd/db/netusage.sqlite"
-]
-
-
-class Netusage(NetBase):
-    """This class extracts data from netusage.sqlite and attempts to identify
-    any suspicious processes if running on a full filesystem dump.
-
-
-    """
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        for netusage_path in self._get_fs_files_from_patterns(NETUSAGE_ROOT_PATHS):
-            self.file_path = netusage_path
-            self.log.info("Found NetUsage database at path: %s", self.file_path)
-            try:
-                self._extract_net_data()
-            except sqlite3.OperationalError as e:
-                self.log.info("Skipping this NetUsage database because it seems empty or malformed: %s", e)
-                continue
-
-        self._find_suspicious_processes()

mvt/ios/modules/fs/shutdownlog.py

@@ -1,87 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-SHUTDOWN_LOG_PATH = [
-    "private/var/db/diagnostics/shutdown.log",
-]
-
-
-class ShutdownLog(IOSExtraction):
-    """This module extracts processes information from the shutdown log file."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "shutdown",
-            "data": f"Client {record['client']} with PID {record['pid']} was running when the device was shut down",
-        }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if self.indicators.check_file_path(result["client"]):
-                    self.detected.append(result)
-                    continue
-
-            for ioc in self.indicators.get_iocs("processes"):
-                parts = result["client"].split("/")
-                if ioc in parts:
-                    self.log.warning("Found mention of a known malicious process \"%s\" in shutdown.log",
-                                     ioc)
-                    self.detected.append(result)
-                    continue
-
-    def process_shutdownlog(self, content):
-        current_processes = []
-        for line in content.split("\n"):
-            line = line.strip()
-
-            if line.startswith("remaining client pid:"):
-                current_processes.append({
-                    "pid": line[line.find("pid: ")+5:line.find(" (")],
-                    "client": line[line.find("(")+1:line.find(")")],
-                })
-            elif line.startswith("SIGTERM: "):
-                try:
-                    mac_timestamp = int(line[line.find("[")+1:line.find("]")])
-                except ValueError:
-                    try:
-                        start = line.find(" @")+2
-                        mac_timestamp = int(line[start:start+10])
-                    except Exception:
-                        mac_timestamp = 0
-
-                timestamp = convert_mactime_to_unix(mac_timestamp, from_2001=False)
-                isodate = convert_timestamp_to_iso(timestamp)
-
-                for current_process in current_processes:
-                    self.results.append({
-                        "isodate": isodate,
-                        "pid": current_process["pid"],
-                        "client": current_process["client"],
-                    })
-
-                current_processes = []
-
-        self.results = sorted(self.results, key=lambda entry: entry["isodate"])
-
-    def run(self):
-        self._find_ios_database(root_paths=SHUTDOWN_LOG_PATH)
-        self.log.info("Found shutdown log at path: %s", self.file_path)
-        with open(self.file_path, "r") as handle:
-            self.process_shutdownlog(handle.read())

mvt/ios/modules/fs/version_history.py

@@ -1,48 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import datetime
-import json
-
-from mvt.common.utils import convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-IOS_ANALYTICS_JOURNAL_PATHS = [
-    "private/var/db/analyticsd/Analytics-Journal-*.ips",
-]
-
-
-class IOSVersionHistory(IOSExtraction):
-    """This module extracts iOS update history from Analytics Journal log files."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "ios_version",
-            "data": f"Recorded iOS version {record['os_version']}",
-        }
-
-    def run(self):
-        for found_path in self._get_fs_files_from_patterns(IOS_ANALYTICS_JOURNAL_PATHS):
-            with open(found_path, "r") as analytics_log:
-                log_line = json.loads(analytics_log.readline().strip())
-
-                timestamp = datetime.datetime.strptime(log_line["timestamp"],
-                                                       "%Y-%m-%d %H:%M:%S.%f %z")
-                timestamp_utc = timestamp.astimezone(datetime.timezone.utc)
-                self.results.append({
-                    "isodate": convert_timestamp_to_iso(timestamp_utc),
-                    "os_version": log_line["os_version"],
-                })
-
-        self.results = sorted(self.results, key=lambda entry: entry["isodate"])

mvt/ios/modules/fs/webkit_safariviewservice.py

@@ -1,29 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .webkit_base import WebkitBase
-
-WEBKIT_SAFARIVIEWSERVICE_ROOT_PATHS = [
-    "private/var/mobile/Containers/Data/Application/*/SystemData/com.apple.SafariViewService/Library/WebKit/WebsiteData/",
-]
-
-
-class WebkitSafariViewService(WebkitBase):
-    """This module looks extracts records from WebKit LocalStorage folders,
-    and checks them against any provided list of suspicious domains.
-
-
-    """
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._process_webkit_folder(WEBKIT_SAFARIVIEWSERVICE_ROOT_PATHS)
-        self.log.info("Extracted a total of %d records from WebKit SafariViewService WebsiteData",
-                      len(self.results))

mvt/ios/modules/mixed/calls.py

@@ -1,63 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import sqlite3
-
-from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-CALLS_BACKUP_IDS = [
-    "5a4935c78a5255723f707230a451d79c540d2741",
-]
-CALLS_ROOT_PATHS = [
-    "private/var/mobile/Library/CallHistoryDB/CallHistory.storedata"
-]
-
-
-class Calls(IOSExtraction):
-    """This module extracts phone calls details"""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "call",
-            "data": f"From {record['number']} using {record['provider']} during {record['duration']} seconds"
-        }
-
-    def run(self):
-        self._find_ios_database(backup_ids=CALLS_BACKUP_IDS,
-                                root_paths=CALLS_ROOT_PATHS)
-        self.log.info("Found Calls database at path: %s", self.file_path)
-
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                ZDATE, ZDURATION, ZLOCATION, ZADDRESS, ZSERVICE_PROVIDER
-            FROM ZCALLRECORD;
-        """)
-        # names = [description[0] for description in cur.description]
-
-        for row in cur:
-            self.results.append({
-                "isodate": convert_timestamp_to_iso(convert_mactime_to_unix(row[0])),
-                "duration": row[1],
-                "location": row[2],
-                "number": row[3].decode("utf-8") if row[3] and row[3] is bytes else row[3],
-                "provider": row[4]
-            })
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d calls", len(self.results))

mvt/ios/modules/mixed/chrome_history.py

@@ -1,79 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import sqlite3
-
-from mvt.common.utils import (convert_chrometime_to_unix,
-                              convert_timestamp_to_iso)
-
-from ..base import IOSExtraction
-
-CHROME_HISTORY_BACKUP_IDS = [
-    "faf971ce92c3ac508c018dce1bef2a8b8e9838f1",
-]
-# TODO: Confirm Chrome database path.
-CHROME_HISTORY_ROOT_PATHS = [
-    "private/var/mobile/Containers/Data/Application/*/Library/Application Support/Google/Chrome/Default/History",
-]
-
-
-class ChromeHistory(IOSExtraction):
-    """This module extracts all Chome visits."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "visit",
-            "data": f"{record['id']} - {record['url']} (visit ID: {record['visit_id']}, redirect source: {record['redirect_source']})"
-        }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if self.indicators.check_domain(result["url"]):
-                self.detected.append(result)
-
-    def run(self):
-        self._find_ios_database(backup_ids=CHROME_HISTORY_BACKUP_IDS,
-                                root_paths=CHROME_HISTORY_ROOT_PATHS)
-        self.log.info("Found Chrome history database at path: %s", self.file_path)
-
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                urls.id,
-                urls.url,
-                visits.id,
-                visits.visit_time,
-                visits.from_visit
-            FROM urls
-            JOIN visits ON visits.url = urls.id
-            ORDER BY visits.visit_time;
-        """)
-
-        for item in cur:
-            self.results.append({
-                "id": item[0],
-                "url": item[1],
-                "visit_id": item[2],
-                "timestamp": item[3],
-                "isodate": convert_timestamp_to_iso(convert_chrometime_to_unix(item[3])),
-                "redirect_source": item[4],
-            })
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d history items", len(self.results))

mvt/ios/modules/mixed/contacts.py

@@ -1,54 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import sqlite3
-
-from ..base import IOSExtraction
-
-CONTACTS_BACKUP_IDS = [
-    "31bb7ba8914766d4ba40d6dfb6113c8b614be442",
-]
-CONTACTS_ROOT_PATHS = [
-    "private/var/mobile/Library/AddressBook/AddressBook.sqlitedb",
-]
-
-
-class Contacts(IOSExtraction):
-    """This module extracts all contact details from the phone's address book."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._find_ios_database(backup_ids=CONTACTS_BACKUP_IDS, root_paths=CONTACTS_ROOT_PATHS)
-        self.log.info("Found Contacts database at path: %s", self.file_path)
-
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                multi.value, person.first, person.middle, person.last,
-                person.organization
-            FROM ABPerson person, ABMultiValue multi
-            WHERE person.rowid = multi.record_id and multi.value not null
-            ORDER by person.rowid ASC;
-        """)
-        names = [description[0] for description in cur.description]
-
-        for row in cur:
-            new_contact = {}
-            for index, value in enumerate(row):
-                new_contact[names[index]] = value
-
-            self.results.append(new_contact)
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d contacts from the address book",
-                      len(self.results))

mvt/ios/modules/mixed/firefox_favicon.py

@@ -1,84 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import sqlite3
-from datetime import datetime
-
-from mvt.common.utils import convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-FIREFOX_HISTORY_BACKUP_IDS = [
-    "2e57c396a35b0d1bcbc624725002d98bd61d142b",
-]
-FIREFOX_HISTORY_ROOT_PATHS = [
-    "private/var/mobile/profile.profile/browser.db",
-]
-
-
-class FirefoxFavicon(IOSExtraction):
-    """This module extracts all Firefox favicon"""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "firefox_history",
-            "data": f"Firefox favicon {record['url']} when visiting {record['history_url']}",
-        }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if (self.indicators.check_domain(result.get("url", "")) or
-                    self.indicators.check_domain(result.get("history_url", ""))):
-                self.detected.append(result)
-
-    def run(self):
-        self._find_ios_database(backup_ids=FIREFOX_HISTORY_BACKUP_IDS,
-                                root_paths=FIREFOX_HISTORY_ROOT_PATHS)
-        self.log.info("Found Firefox favicon database at path: %s", self.file_path)
-
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                favicons.id,
-                favicons.url,
-                favicons.width,
-                favicons.height,
-                favicons.type,
-                favicons.date,
-                history.id,
-                history.url
-            FROM favicons
-            INNER JOIN favicon_sites ON favicon_sites.faviconID = favicons.id
-            INNER JOIN history ON favicon_sites.siteID = history.id;
-        """)
-
-        for item in cur:
-            self.results.append({
-                "id": item[0],
-                "url": item[1],
-                "width": item[2],
-                "height": item[3],
-                "type": item[4],
-                "isodate": convert_timestamp_to_iso(datetime.utcfromtimestamp(item[5])),
-                "history_id": item[6],
-                "history_url": item[7]
-            })
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d history items", len(self.results))

mvt/ios/modules/mixed/interactionc.py

@@ -1,174 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import sqlite3
-
-from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-INTERACTIONC_BACKUP_IDS = [
-    "1f5a521220a3ad80ebfdc196978df8e7a2e49dee",
-]
-INTERACTIONC_ROOT_PATHS = [
-    "private/var/mobile/Library/CoreDuet/People/interactionC.db",
-]
-
-
-class InteractionC(IOSExtraction):
-    """This module extracts data from InteractionC db."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.timestamps = [
-            "start_date",
-            "end_date",
-            "interactions_creation_date",
-            "contacts_creation_date",
-            "first_incoming_recipient_date",
-            "first_incoming_sender_date",
-            "first_outgoing_recipient_date",
-            "last_incoming_sender_date",
-            "last_incoming_recipient_date",
-            "last_outgoing_recipient_date",
-        ]
-
-    def serialize(self, record):
-        records = []
-        processed = []
-        for ts in self.timestamps:
-            # Check if the record has the current timestamp.
-            if ts not in record or not record[ts]:
-                continue
-
-            # Check if the timestamp was already processed.
-            if record[ts] in processed:
-                continue
-
-            records.append({
-                "timestamp": record[ts],
-                "module": self.__class__.__name__,
-                "event": ts,
-                "data": f"[{record['bundle_id']}] {record['account']} - from {record['sender_display_name']} "
-                        f"({record['sender_identifier']}) to {record['recipient_display_name']} "
-                        f"({record['recipient_identifier']}): {record['content']}"
-            })
-            processed.append(record[ts])
-
-        return records
-
-    def run(self):
-        self._find_ios_database(backup_ids=INTERACTIONC_BACKUP_IDS, root_paths=INTERACTIONC_ROOT_PATHS)
-        self.log.info("Found InteractionC database at path: %s", self.file_path)
-
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-
-        # TODO: Support all versions.
-        # Taken from:
-        # https://github.com/mac4n6/APOLLO/blob/master/modules/interaction_contact_interactions.txt
-        cur.execute("""
-            SELECT
-                ZINTERACTIONS.ZSTARTDATE,
-                ZINTERACTIONS.ZENDDATE,
-                ZINTERACTIONS.ZBUNDLEID,
-                ZINTERACTIONS.ZACCOUNT,
-                ZINTERACTIONS.ZTARGETBUNDLEID,
-                CASE ZINTERACTIONS.ZDIRECTION
-                    WHEN '0' THEN 'INCOMING'
-                    WHEN '1' THEN 'OUTGOING'
-                END 'DIRECTION',
-                ZCONTACTS.ZDISPLAYNAME,
-                ZCONTACTS.ZIDENTIFIER,
-                ZCONTACTS.ZPERSONID,
-                RECEIPIENTCONACT.ZDISPLAYNAME,
-                RECEIPIENTCONACT.ZIDENTIFIER,
-                RECEIPIENTCONACT.ZPERSONID,
-                ZINTERACTIONS.ZRECIPIENTCOUNT,
-                ZINTERACTIONS.ZDOMAINIDENTIFIER,
-                ZINTERACTIONS.ZISRESPONSE,
-                ZATTACHMENT.ZCONTENTTEXT,
-                ZATTACHMENT.ZUTI,
-                ZATTACHMENT.ZCONTENTURL,
-                ZATTACHMENT.ZSIZEINBYTES,
-                ZATTACHMENT.ZPHOTOLOCALIDENTIFIER,
-                HEX(ZATTACHMENT.ZIDENTIFIER),
-                ZATTACHMENT.ZCLOUDIDENTIFIER,
-                ZCONTACTS.ZINCOMINGRECIPIENTCOUNT,
-                ZCONTACTS.ZINCOMINGSENDERCOUNT,
-                ZCONTACTS.ZOUTGOINGRECIPIENTCOUNT,
-                ZINTERACTIONS.ZCREATIONDATE,
-                ZCONTACTS.ZCREATIONDATE,
-                ZCONTACTS.ZFIRSTINCOMINGRECIPIENTDATE,
-                ZCONTACTS.ZFIRSTINCOMINGSENDERDATE,
-                ZCONTACTS.ZFIRSTOUTGOINGRECIPIENTDATE,
-                ZCONTACTS.ZLASTINCOMINGSENDERDATE,
-                ZCONTACTS.ZLASTINCOMINGRECIPIENTDATE,
-                ZCONTACTS.ZLASTOUTGOINGRECIPIENTDATE,
-                ZCONTACTS.ZCUSTOMIDENTIFIER,
-                ZINTERACTIONS.ZCONTENTURL,
-                ZINTERACTIONS.ZLOCATIONUUID,
-                ZINTERACTIONS.ZGROUPNAME,
-                ZINTERACTIONS.ZDERIVEDINTENTIDENTIFIER,
-                ZINTERACTIONS.Z_PK
-            FROM ZINTERACTIONS
-                LEFT JOIN ZCONTACTS ON ZINTERACTIONS.ZSENDER = ZCONTACTS.Z_PK
-                LEFT JOIN Z_1INTERACTIONS ON ZINTERACTIONS.Z_PK == Z_1INTERACTIONS.Z_3INTERACTIONS
-                LEFT JOIN ZATTACHMENT ON Z_1INTERACTIONS.Z_1ATTACHMENTS == ZATTACHMENT.Z_PK
-                LEFT JOIN Z_2INTERACTIONRECIPIENT ON ZINTERACTIONS.Z_PK== Z_2INTERACTIONRECIPIENT.Z_3INTERACTIONRECIPIENT
-                LEFT JOIN ZCONTACTS RECEIPIENTCONACT ON Z_2INTERACTIONRECIPIENT.Z_2RECIPIENTS== RECEIPIENTCONACT.Z_PK;
-        """)
-        # names = [description[0] for description in cur.description]
-
-        for row in cur:
-            self.results.append({
-                "start_date": convert_timestamp_to_iso(convert_mactime_to_unix(row[0])),
-                "end_date": convert_timestamp_to_iso(convert_mactime_to_unix(row[1])),
-                "bundle_id": row[2],
-                "account": row[3],
-                "target_bundle_id": row[4],
-                "direction": row[5],
-                "sender_display_name": row[6],
-                "sender_identifier": row[7],
-                "sender_personid": row[8],
-                "recipient_display_name": row[9],
-                "recipient_identifier": row[10],
-                "recipient_personid": row[11],
-                "recipient_count": row[12],
-                "domain_identifier": row[13],
-                "is_response": row[14],
-                "content": row[15],
-                "uti": row[16],
-                "content_url": row[17],
-                "size": row[18],
-                "photo_local_id": row[19],
-                "attachment_id": row[20],
-                "cloud_id": row[21],
-                "incoming_recipient_count": row[22],
-                "incoming_sender_count": row[23],
-                "outgoing_recipient_count": row[24],
-                "interactions_creation_date": convert_timestamp_to_iso(convert_mactime_to_unix(row[25])) if row[25] else None,
-                "contacts_creation_date": convert_timestamp_to_iso(convert_mactime_to_unix(row[26])) if row[26] else None,
-                "first_incoming_recipient_date": convert_timestamp_to_iso(convert_mactime_to_unix(row[27])) if row[27] else None,
-                "first_incoming_sender_date": convert_timestamp_to_iso(convert_mactime_to_unix(row[28])) if row[28] else None,
-                "first_outgoing_recipient_date": convert_timestamp_to_iso(convert_mactime_to_unix(row[29])) if row[29] else None,
-                "last_incoming_sender_date": convert_timestamp_to_iso(convert_mactime_to_unix(row[30])) if row[30] else None,
-                "last_incoming_recipient_date": convert_timestamp_to_iso(convert_mactime_to_unix(row[31])) if row[31] else None,
-                "last_outgoing_recipient_date": convert_timestamp_to_iso(convert_mactime_to_unix(row[32])) if row[32] else None,
-                "custom_id": row[33],
-                "location_uuid": row[35],
-                "group_name": row[36],
-                "derivied_intent_id": row[37],
-                "table_id": row[38]
-            })
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d InteractionC events", len(self.results))

mvt/ios/modules/mixed/locationd.py

@@ -1,115 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import plistlib
-
-from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-LOCATIOND_BACKUP_IDS = [
-    "a690d7769cce8904ca2b67320b107c8fe5f79412",
-]
-LOCATIOND_ROOT_PATHS = [
-    "private/var/mobile/Library/Caches/locationd/clients.plist",
-    "private/var/root/Library/Caches/locationd/clients.plist"
-]
-
-
-class LocationdClients(IOSExtraction):
-    """Extract information from apps who used geolocation."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.timestamps = [
-            "ConsumptionPeriodBegin",
-            "ReceivingLocationInformationTimeStopped",
-            "VisitTimeStopped",
-            "LocationTimeStopped",
-            "BackgroundLocationTimeStopped",
-            "SignificantTimeStopped",
-            "NonPersistentSignificantTimeStopped",
-            "FenceTimeStopped",
-            "BeaconRegionTimeStopped",
-        ]
-
-    def serialize(self, record):
-        records = []
-        for timestamp in self.timestamps:
-            if timestamp in record.keys():
-                records.append({
-                    "timestamp": record[timestamp],
-                    "module": self.__class__.__name__,
-                    "event": timestamp,
-                    "data": f"{timestamp} from {record['package']}"
-                })
-
-        return records
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            parts = result["package"].split("/")
-            proc_name = parts[len(parts)-1]
-
-            if self.indicators.check_process(proc_name):
-                self.log.warning("Found a suspicious process name in LocationD entry %s",
-                                 result["package"])
-                self.detected.append(result)
-                continue
-
-            if "BundlePath" in result:
-                if self.indicators.check_file_path(result["BundlePath"]):
-                    self.log.warning("Found a suspicious file path in Location D: %s",
-                                     result["BundlePath"])
-                    self.detected.append(result)
-                    continue
-
-            if "Executable" in result:
-                if self.indicators.check_file_path(result["Executable"]):
-                    self.log.warning("Found a suspicious file path in Location D: %s",
-                                     result["Executable"])
-                    self.detected.append(result)
-                    continue
-
-            if "Registered" in result:
-                if self.indicators.check_file_path(result["Registered"]):
-                    self.log.warning("Found a suspicious file path in Location D: %s",
-                                     result["Registered"])
-                    self.detected.append(result)
-                    continue
-
-    def _extract_locationd_entries(self, file_path):
-        with open(file_path, "rb") as handle:
-            file_plist = plistlib.load(handle)
-
-        for key, values in file_plist.items():
-            result = file_plist[key]
-            result["package"] = key
-            for ts in self.timestamps:
-                if ts in result.keys():
-                    result[ts] = convert_timestamp_to_iso(convert_mactime_to_unix(result[ts]))
-
-            self.results.append(result)
-
-    def run(self):
-
-        if self.is_backup:
-            self._find_ios_database(backup_ids=LOCATIOND_BACKUP_IDS)
-            self.log.info("Found Locationd Clients plist at path: %s", self.file_path)
-            self._extract_locationd_entries(self.file_path)
-        elif self.is_fs_dump:
-            for locationd_path in self._get_fs_files_from_patterns(LOCATIOND_ROOT_PATHS):
-                self.file_path = locationd_path
-                self.log.info("Found Locationd Clients plist at path: %s", self.file_path)
-                self._extract_locationd_entries(self.file_path)
-
-        self.log.info("Extracted a total of %d Locationd Clients entries", len(self.results))

mvt/ios/modules/mixed/osanalytics_addaily.py

@@ -1,65 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import plistlib
-
-from mvt.common.utils import convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-OSANALYTICS_ADDAILY_BACKUP_IDS = [
-    "f65b5fafc69bbd3c60be019c6e938e146825fa83",
-]
-OSANALYTICS_ADDAILY_ROOT_PATHS = [
-    "private/var/mobile/Library/Preferences/com.apple.osanalytics.addaily.plist",
-]
-
-
-class OSAnalyticsADDaily(IOSExtraction):
-    """Extract network usage information by process, from com.apple.osanalytics.addaily.plist"""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        record_data = f"{record['package']} WIFI IN: {record['wifi_in']}, WIFI OUT: {record['wifi_out']} - "  \
-                      f"WWAN IN: {record['wwan_in']}, WWAN OUT: {record['wwan_out']}"
-        return {
-            "timestamp": record["ts"],
-            "module": self.__class__.__name__,
-            "event": "osanalytics_addaily",
-            "data": record_data,
-        }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if self.indicators.check_process(result["package"]):
-                self.detected.append(result)
-
-    def run(self):
-        self._find_ios_database(backup_ids=OSANALYTICS_ADDAILY_BACKUP_IDS,
-                                root_paths=OSANALYTICS_ADDAILY_ROOT_PATHS)
-        self.log.info("Found com.apple.osanalytics.addaily plist at path: %s", self.file_path)
-
-        with open(self.file_path, "rb") as handle:
-            file_plist = plistlib.load(handle)
-
-        for app, values in file_plist.get("netUsageBaseline", {}).items():
-            self.results.append({
-                "package": app,
-                "ts": convert_timestamp_to_iso(values[0]),
-                "wifi_in": values[1],
-                "wifi_out": values[2],
-                "wwan_in": values[3],
-                "wwan_out": values[4],
-            })
-
-        self.log.info("Extracted a total of %d com.apple.osanalytics.addaily entries", len(self.results))

mvt/ios/modules/mixed/safari_browserstate.py

@@ -1,124 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import io
-import os
-import plistlib
-import sqlite3
-
-from mvt.common.utils import (convert_mactime_to_unix,
-                              convert_timestamp_to_iso, keys_bytes_to_string)
-
-from ..base import IOSExtraction
-
-SAFARI_BROWSER_STATE_BACKUP_RELPATH = "Library/Safari/BrowserState.db"
-SAFARI_BROWSER_STATE_ROOT_PATHS = [
-    "private/var/mobile/Library/Safari/BrowserState.db",
-    "private/var/mobile/Containers/Data/Application/*/Library/Safari/BrowserState.db",
-]
-
-
-class SafariBrowserState(IOSExtraction):
-    """This module extracts all Safari browser state records."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self._session_history_count = 0
-
-    def serialize(self, record):
-        return {
-            "timestamp": record["last_viewed_timestamp"],
-            "module": self.__class__.__name__,
-            "event": "tab",
-            "data": f"{record['tab_title']} - {record['tab_url']}"
-        }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if "tab_url" in result and self.indicators.check_domain(result["tab_url"]):
-                self.detected.append(result)
-                continue
-
-            if "session_data" not in result:
-                continue
-
-            for session_entry in result["session_data"]:
-                if "entry_url" in session_entry and self.indicators.check_domain(session_entry["entry_url"]):
-                    self.detected.append(result)
-
-    def _process_browser_state_db(self, db_path):
-        conn = sqlite3.connect(db_path)
-
-        cur = conn.cursor()
-        try:
-            cur.execute("""
-                SELECT
-                    tabs.title,
-                    tabs.url,
-                    tabs.user_visible_url,
-                    tabs.last_viewed_time,
-                    tab_sessions.session_data
-                FROM tabs
-                JOIN tab_sessions ON tabs.uuid = tab_sessions.tab_uuid
-                ORDER BY tabs.last_viewed_time;
-            """)
-        except sqlite3.OperationalError:
-            # Old version iOS <12 likely
-            cur.execute("""
-                SELECT
-                    title, url, user_visible_url, last_viewed_time, session_data
-                FROM tabs
-                ORDER BY last_viewed_time;
-            """)
-
-        for row in cur:
-            session_entries = []
-
-            if row[4]:
-                # Skip a 4 byte header before the plist content.
-                session_plist = row[4][4:]
-                session_data = plistlib.load(io.BytesIO(session_plist))
-                session_data = keys_bytes_to_string(session_data)
-
-                if "SessionHistoryEntries" in session_data.get("SessionHistory", {}):
-                    for session_entry in session_data["SessionHistory"].get("SessionHistoryEntries"):
-                        self._session_history_count += 1
-                        session_entries.append({
-                            "entry_title": session_entry.get("SessionHistoryEntryOriginalURL"),
-                            "entry_url": session_entry.get("SessionHistoryEntryURL"),
-                            "data_length": len(session_entry.get("SessionHistoryEntryData")) if "SessionHistoryEntryData" in session_entry else 0,
-                        })
-
-            self.results.append({
-                "tab_title": row[0],
-                "tab_url": row[1],
-                "tab_visible_url": row[2],
-                "last_viewed_timestamp": convert_timestamp_to_iso(convert_mactime_to_unix(row[3])),
-                "session_data": session_entries,
-                "safari_browser_state_db": os.path.relpath(db_path, self.base_folder),
-            })
-
-    def run(self):
-
-        if self.is_backup:
-            for backup_file in self._get_backup_files_from_manifest(relative_path=SAFARI_BROWSER_STATE_BACKUP_RELPATH):
-                self.file_path = self._get_backup_file_from_id(backup_file["file_id"])
-                self.log.info("Found Safari browser state database at path: %s", self.file_path)
-                self._process_browser_state_db(self.file_path)
-        elif self.is_fs_dump:
-            for safari_browserstate_path in self._get_fs_files_from_patterns(SAFARI_BROWSER_STATE_ROOT_PATHS):
-                self.file_path = safari_browserstate_path
-                self.log.info("Found Safari browser state database at path: %s", self.file_path)
-                self._process_browser_state_db(self.file_path)
-
-        self.log.info("Extracted a total of %d tab records and %d session history entries",
-                      len(self.results), self._session_history_count)

mvt/ios/modules/mixed/shortcuts.py

@@ -1,119 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import io
-import itertools
-import plistlib
-import sqlite3
-
-from mvt.common.utils import (check_for_links, convert_mactime_to_unix,
-                              convert_timestamp_to_iso)
-
-from ..base import IOSExtraction
-
-SHORTCUT_BACKUP_IDS = [
-    "5b4d0b44b5990f62b9f4d34ad8dc382bf0b01094",
-]
-SHORTCUT_ROOT_PATHS = [
-    "private/var/mobile/Library/Shortcuts/Shortcuts.sqlite",
-]
-
-
-class Shortcuts(IOSExtraction):
-    """This module extracts all info about SMS/iMessage attachments."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        found_urls = ""
-        if record["action_urls"]:
-            found_urls = "- URLs in actions: {}".format(", ".join(record["action_urls"]))
-        desc = ""
-        if record["description"]:
-            desc = record["description"].decode('utf-8', errors='ignore')
-
-        return [{
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "shortcut_created",
-            "data": f"iOS Shortcut '{record['shortcut_name'].decode('utf-8')}': {desc} {found_urls}"
-        }, {
-            "timestamp": record["modified_date"],
-            "module": self.__class__.__name__,
-            "event": "shortcut_modified",
-            "data": f"iOS Shortcut '{record['shortcut_name'].decode('utf-8')}': {desc} {found_urls}"
-        }]
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for action in self.results:
-            if self.indicators.check_domains(action["action_urls"]):
-                self.detected.append(action)
-
-    def run(self):
-        self._find_ios_database(backup_ids=SHORTCUT_BACKUP_IDS,
-                                root_paths=SHORTCUT_ROOT_PATHS)
-        self.log.info("Found Shortcuts database at path: %s", self.file_path)
-
-        conn = sqlite3.connect(self.file_path)
-        conn.text_factory = bytes
-        cur = conn.cursor()
-        try:
-            cur.execute("""
-                SELECT
-                    ZSHORTCUT.Z_PK as "shortcut_id",
-                    ZSHORTCUT.ZNAME as "shortcut_name",
-                    ZSHORTCUT.ZCREATIONDATE as "created_date",
-                    ZSHORTCUT.ZMODIFICATIONDATE as "modified_date",
-                    ZSHORTCUT.ZACTIONSDESCRIPTION as "description",
-                    ZSHORTCUTACTIONS.ZDATA as "action_data"
-                FROM ZSHORTCUT
-                LEFT JOIN ZSHORTCUTACTIONS ON ZSHORTCUTACTIONS.ZSHORTCUT == ZSHORTCUT.Z_PK;
-            """)
-        except sqlite3.OperationalError:
-            # Table ZSHORTCUT does not exist
-            self.log.info("Invalid shortcut database format, skipping...")
-            cur.close()
-            conn.close()
-            return
-
-        names = [description[0] for description in cur.description]
-
-        for item in cur:
-            shortcut = {}
-            # We store the value of each column under the proper key.
-            for index, value in enumerate(item):
-                shortcut[names[index]] = value
-
-            action_data = plistlib.load(io.BytesIO(shortcut.pop("action_data", [])))
-            actions = []
-            for action_entry in action_data:
-                action = {}
-                action["identifier"] = action_entry["WFWorkflowActionIdentifier"]
-                action["parameters"] = action_entry["WFWorkflowActionParameters"]
-
-                # URLs might be in multiple fields, do a simple regex search across the parameters.
-                extracted_urls = check_for_links(str(action["parameters"]))
-
-                # Remove quoting characters that may have been captured by the regex.
-                action["urls"] = [url.rstrip("',") for url in extracted_urls]
-                actions.append(action)
-
-            shortcut["isodate"] = convert_timestamp_to_iso(convert_mactime_to_unix(shortcut.pop("created_date")))
-            shortcut["modified_date"] = convert_timestamp_to_iso(convert_mactime_to_unix(shortcut["modified_date"]))
-            shortcut["parsed_actions"] = len(actions)
-            shortcut["action_urls"] = list(itertools.chain(*[action["urls"] for action in actions]))
-            self.results.append(shortcut)
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d Shortcuts", len(self.results))

mvt/ios/modules/mixed/sms.py

@@ -1,119 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import sqlite3
-from base64 import b64encode
-
-from mvt.common.utils import (check_for_links, convert_mactime_to_unix,
-                              convert_timestamp_to_iso)
-
-from ..base import IOSExtraction
-
-SMS_BACKUP_IDS = [
-    "3d0d7e5fb2ce288813306e4d4636395e047a3d28",
-]
-SMS_ROOT_PATHS = [
-    "private/var/mobile/Library/SMS/sms.db",
-]
-
-
-class SMS(IOSExtraction):
-    """This module extracts all SMS messages containing links."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        text = record["text"].replace("\n", "\\n")
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "sms_received",
-            "data": f"{record['service']}: {record['guid']} \"{text}\" from {record['phone_number']} ({record['account']})"
-        }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for message in self.results:
-            message_links = check_for_links(message.get("text", ""))
-            if self.indicators.check_domains(message_links):
-                self.detected.append(message)
-
-    def run(self):
-        self._find_ios_database(backup_ids=SMS_BACKUP_IDS,
-                                root_paths=SMS_ROOT_PATHS)
-        self.log.info("Found SMS database at path: %s", self.file_path)
-
-        try:
-            conn = sqlite3.connect(self.file_path)
-            cur = conn.cursor()
-            cur.execute("""
-                SELECT
-                    message.*,
-                    handle.id as "phone_number"
-                FROM message, handle
-                WHERE handle.rowid = message.handle_id;
-            """)
-            # Force the query early to catch database issues
-            items = list(cur)
-        except sqlite3.DatabaseError as e:
-            conn.close()
-            if "database disk image is malformed" in str(e):
-                self._recover_sqlite_db_if_needed(self.file_path, forced=True)
-                conn = sqlite3.connect(self.file_path)
-                cur = conn.cursor()
-                cur.execute("""
-                    SELECT
-                        message.*,
-                        handle.id as "phone_number"
-                    FROM message, handle
-                    WHERE handle.rowid = message.handle_id;
-                """)
-                items = list(cur)
-            else:
-                raise e
-        names = [description[0] for description in cur.description]
-
-        for item in items:
-            message = {}
-            for index, value in enumerate(item):
-                # We base64 escape some of the attributes that could contain
-                # binary data.
-                if (names[index] == "attributedBody" or
-                        names[index] == "payload_data" or
-                        names[index] == "message_summary_info") and value:
-                    value = b64encode(value).decode()
-
-                # We store the value of each column under the proper key.
-                message[names[index]] = value
-
-            # We convert Mac's ridiculous timestamp format.
-            message["isodate"] = convert_timestamp_to_iso(convert_mactime_to_unix(message["date"]))
-            message["direction"] = ("sent" if message.get("is_from_me", 0) == 1 else "received")
-
-            # Sometimes "text" is None instead of empty string.
-            if not message.get("text", None):
-                message["text"] = ""
-
-            if message.get("text", "").startswith("ALERT: State-sponsored attackers may be targeting your iPhone"):
-                self.log.warn("Apple warning about state-sponsored attack received on the %s", message["isodate"])
-                self.results.append(message)
-            else:
-                # Extract links from the SMS message.
-                message_links = check_for_links(message.get("text", ""))
-
-                # If we find links in the messages or if they are empty we add them to the list.
-                if message_links or message.get("text", "").strip() == "":
-                    self.results.append(message)
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d SMS messages containing links", len(self.results))

mvt/ios/modules/mixed/sms_attachments.py

@@ -1,86 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import sqlite3
-from base64 import b64encode
-
-from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-SMS_BACKUP_IDS = [
-    "3d0d7e5fb2ce288813306e4d4636395e047a3d28",
-]
-SMS_ROOT_PATHS = [
-    "private/var/mobile/Library/SMS/sms.db",
-]
-
-
-class SMSAttachments(IOSExtraction):
-    """This module extracts all info about SMS/iMessage attachments."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "sms_attachment",
-            "data": f"{record['service']}: Attachment '{record['transfer_name']}' {record['direction']} from {record['phone_number']} "
-                    f"with {record['total_bytes']} bytes (is_sticker: {record['is_sticker']}, has_user_info: {record['has_user_info']})"
-        }
-
-    def run(self):
-        self._find_ios_database(backup_ids=SMS_BACKUP_IDS,
-                                root_paths=SMS_ROOT_PATHS)
-        self.log.info("Found SMS database at path: %s", self.file_path)
-
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                attachment.ROWID as "attachment_id",
-                attachment.*,
-                message.service as "service",
-                handle.id as "phone_number"
-            FROM attachment
-            LEFT JOIN message_attachment_join ON message_attachment_join.attachment_id = attachment.ROWID
-            LEFT JOIN message ON message.ROWID = message_attachment_join.message_id
-            LEFT JOIN handle ON handle.ROWID = message.handle_id;
-        """)
-        names = [description[0] for description in cur.description]
-
-        for item in cur:
-            attachment = {}
-            for index, value in enumerate(item):
-                if (names[index] in ["user_info", "sticker_user_info",
-                                     "attribution_info",
-                                     "ck_server_change_token_blob",
-                                     "sr_ck_server_change_token_blob"]) and value:
-                    value = b64encode(value).decode()
-                attachment[names[index]] = value
-
-            attachment["isodate"] = convert_timestamp_to_iso(convert_mactime_to_unix(attachment["created_date"]))
-            attachment["start_date"] = convert_timestamp_to_iso(convert_mactime_to_unix(attachment["start_date"]))
-            attachment["direction"] = ("sent" if attachment["is_outgoing"] == 1 else "received")
-            attachment["has_user_info"] = attachment["user_info"] is not None
-            attachment["service"] = attachment["service"] or "Unknown"
-            attachment["filename"] = attachment["filename"] or "NULL"
-
-            if (attachment["filename"].startswith("/var/tmp/") and attachment["filename"].endswith("-1") and
-                    attachment["direction"] == "received"):
-                self.log.warn(f"Suspicious iMessage attachment '{attachment['filename']}' on {attachment['isodate']}")
-                self.detected.append(attachment)
-
-            self.results.append(attachment)
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d SMS attachments", len(self.results))

mvt/ios/modules/mixed/tcc.py

@@ -1,164 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import sqlite3
-from datetime import datetime
-
-from mvt.common.utils import convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-TCC_BACKUP_IDS = [
-    "64d0019cb3d46bfc8cce545a8ba54b93e7ea9347",
-]
-TCC_ROOT_PATHS = [
-    "private/var/mobile/Library/TCC/TCC.db",
-]
-
-AUTH_VALUE_OLD = {
-    0: "denied",
-    1: "allowed"
-}
-
-AUTH_VALUES = {
-    0: "denied",
-    1: "unknown",
-    2: "allowed",
-    3: "limited",
-}
-AUTH_REASONS = {
-    1: "error",
-    2: "user_consent",
-    3: "user_set",
-    4: "system_set",
-    5: "service_policy",
-    6: "mdm_policy",
-    7: "override_policy",
-    8: "missing_usage_string",
-    9: "prompt_timeout",
-    10: "preflight_unknown",
-    11: "entitled",
-    12: "app_type_policy",
-}
-
-
-class TCC(IOSExtraction):
-    """This module extracts records from the TCC.db SQLite database."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record):
-        if "last_modified" in record:
-            if "allowed_value" in record:
-                msg = f"Access to {record['service']} by {record['client']} {record['allowed_value']}"
-            else:
-                msg = f"Access to {record['service']} by {record['client']} {record['auth_value']}"
-            return {
-                "timestamp": record["last_modified"],
-                "module": self.__class__.__name__,
-                "event": "AccessRequest",
-                "data": msg
-            }
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if self.indicators.check_process(result["client"]):
-                self.log.warning("Found malicious process in TCC database: %s", result["client"])
-                self.detected.append(result)
-
-    def process_db(self, file_path):
-        conn = sqlite3.connect(file_path)
-        cur = conn.cursor()
-        db_version = "v3"
-        try:
-            cur.execute("""SELECT
-                service, client, client_type, auth_value, auth_reason, last_modified
-            FROM access;""")
-        except sqlite3.OperationalError:
-            # v2 version
-            try:
-                cur.execute("""SELECT
-                    service, client, client_type, allowed, prompt_count, last_modified
-                    FROM access;""")
-                db_version = "v2"
-            except sqlite3.OperationalError:
-                cur.execute("""SELECT
-                    service, client, client_type, allowed, prompt_count
-                    FROM access;""")
-                db_version = "v1"
-
-
-        for row in cur:
-            service = row[0]
-            client = row[1]
-            client_type = row[2]
-            client_type_desc = "bundle_id" if client_type == 0 else "absolute_path"
-            if db_version == "v3":
-                auth_value = row[3]
-                auth_value_desc = AUTH_VALUES.get(auth_value, "")
-                auth_reason = row[4]
-                auth_reason_desc = AUTH_REASONS.get(auth_reason, "unknown")
-                last_modified = convert_timestamp_to_iso(datetime.utcfromtimestamp((row[5])))
-
-                if service in ["kTCCServiceMicrophone", "kTCCServiceCamera"]:
-                    device = "microphone" if service == "kTCCServiceMicrophone" else "camera"
-                    self.log.info("Found client \"%s\" with access %s to %s on %s by %s",
-                                client, auth_value_desc, device, last_modified, auth_reason_desc)
-
-                self.results.append({
-                    "service": service,
-                    "client": client,
-                    "client_type": client_type_desc,
-                    "auth_value": auth_value_desc,
-                    "auth_reason_desc": auth_reason_desc,
-                    "last_modified": last_modified,
-                })
-            else:
-                allowed_value = row[3]
-                allowed_desc = AUTH_VALUE_OLD.get(allowed_value, "")
-                prompt_count = row[4]
-                if db_version == "v2":
-                    last_modified = convert_timestamp_to_iso(datetime.utcfromtimestamp((row[5])))
-                    if service in ["kTCCServiceMicrophone", "kTCCServiceCamera"]:
-                        device = "microphone" if service == "kTCCServiceMicrophone" else "camera"
-                        self.log.info("Found client \"%s\" with access %s to %s at %s",
-                                    client, allowed_desc, device, last_modified)
-                    self.results.append({
-                        "service": service,
-                        "client": client,
-                        "client_type": client_type_desc,
-                        "allowed_value": allowed_desc,
-                        "prompt_count": prompt_count,
-                        "last_modified": last_modified
-                    })
-                else:
-                    if service in ["kTCCServiceMicrophone", "kTCCServiceCamera"]:
-                        device = "microphone" if service == "kTCCServiceMicrophone" else "camera"
-                        self.log.info("Found client \"%s\" with access %s to %s",
-                                    client, allowed_desc, device)
-                    self.results.append({
-                        "service": service,
-                        "client": client,
-                        "client_type": client_type_desc,
-                        "allowed_value": allowed_desc,
-                        "prompt_count": prompt_count
-                    })
-
-        cur.close()
-        conn.close()
-
-    def run(self):
-        self._find_ios_database(backup_ids=TCC_BACKUP_IDS, root_paths=TCC_ROOT_PATHS)
-        self.log.info("Found TCC database at path: %s", self.file_path)
-        self.process_db(self.file_path)
-
-        self.log.info("Extracted a total of %d TCC items", len(self.results))

mvt/ios/modules/mixed/webkit_resource_load_statistics.py

@@ -1,86 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import datetime
-import os
-import sqlite3
-
-from mvt.common.utils import convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-WEBKIT_RESOURCELOADSTATICS_BACKUP_RELPATH = "Library/WebKit/WebsiteData/ResourceLoadStatistics/observations.db"
-WEBKIT_RESOURCELOADSTATICS_ROOT_PATHS = [
-    "private/var/mobile/Containers/Data/Application/*/Library/WebKit/WebsiteData/ResourceLoadStatistics/observations.db",
-    "private/var/mobile/Containers/Data/Application/*/SystemData/com.apple.SafariViewService/Library/WebKit/WebsiteData/observations.db",
-]
-
-
-class WebkitResourceLoadStatistics(IOSExtraction):
-    """This module extracts records from WebKit ResourceLoadStatistics observations.db."""
-    # TODO: Add serialize().
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = {}
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        self.detected = {}
-        for key, items in self.results.items():
-            for item in items:
-                if self.indicators.check_domain(item["registrable_domain"]):
-                    if key not in self.detected:
-                        self.detected[key] = [item, ]
-                    else:
-                        self.detected[key].append(item)
-
-    def _process_observations_db(self, db_path, key):
-        self.log.info("Found WebKit ResourceLoadStatistics observations.db file at path %s", db_path)
-
-        self._recover_sqlite_db_if_needed(db_path)
-
-        conn = sqlite3.connect(db_path)
-        cur = conn.cursor()
-
-        try:
-            cur.execute("SELECT * from ObservedDomains;")
-        except sqlite3.OperationalError:
-            return
-
-        if key not in self.results:
-            self.results[key] = []
-
-        for row in cur:
-            self.results[key].append({
-                "domain_id": row[0],
-                "registrable_domain": row[1],
-                "last_seen": row[2],
-                "had_user_interaction": bool(row[3]),
-                "last_seen_isodate": convert_timestamp_to_iso(datetime.datetime.utcfromtimestamp(int(row[2]))),
-            })
-
-        if len(self.results[key]) > 0:
-            self.log.info("Extracted a total of %d records from %s", len(self.results[key]), db_path)
-
-    def run(self):
-        if self.is_backup:
-            try:
-                for backup_file in self._get_backup_files_from_manifest(relative_path=WEBKIT_RESOURCELOADSTATICS_BACKUP_RELPATH):
-                    db_path = self._get_backup_file_from_id(backup_file["file_id"])
-                    key = f"{backup_file['domain']}/{WEBKIT_RESOURCELOADSTATICS_BACKUP_RELPATH}"
-                    if db_path:
-                        self._process_observations_db(db_path=db_path, key=key)
-            except Exception as e:
-                self.log.info("Unable to search for WebKit observations.db: %s", e)
-        elif self.is_fs_dump:
-            for db_path in self._get_fs_files_from_patterns(WEBKIT_RESOURCELOADSTATICS_ROOT_PATHS):
-                self._process_observations_db(db_path=db_path, key=os.path.relpath(db_path, self.base_folder))

mvt/ios/modules/mixed/webkit_session_resource_log.py

@@ -1,133 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import plistlib
-
-from mvt.common.utils import convert_timestamp_to_iso
-
-from ..base import IOSExtraction
-
-WEBKIT_SESSION_RESOURCE_LOG_BACKUP_IDS = [
-    "a500ee38053454a02e990957be8a251935e28d3f",
-]
-WEBKIT_SESSION_RESOURCE_LOG_BACKUP_RELPATH = "Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist"
-WEBKIT_SESSION_RESOURCE_LOG_ROOT_PATHS = [
-    "private/var/mobile/Containers/Data/Application/*/SystemData/com.apple.SafariViewService/Library/WebKit/WebsiteData/full_browsing_session_resourceLog.plist",
-    "private/var/mobile/Containers/Data/Application/*/Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist",
-    "private/var/mobile/Library/WebClips/*/Storage/full_browsing_session_resourceLog.plist",
-]
-
-
-class WebkitSessionResourceLog(IOSExtraction):
-    """This module extracts records from WebKit browsing session
-    resource logs, and checks them against any provided list of
-    suspicious domains.
-
-
-    """
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = {}
-
-    @staticmethod
-    def _extract_domains(entries):
-        if not entries:
-            return []
-
-        domains = []
-        for entry in entries:
-            if "origin" in entry:
-                domains.append(entry["origin"])
-            if "domain" in entry:
-                domains.append(entry["domain"])
-
-        return domains
-
-    def check_indicators(self):
-        if not self.indicators:
-            return
-
-        for key, entries in self.results.items():
-            for entry in entries:
-                source_domains = self._extract_domains(entry["redirect_source"])
-                destination_domains = self._extract_domains(entry["redirect_destination"])
-
-                # TODO: Currently not used.
-                # subframe_origins = self._extract_domains(entry["subframe_under_origin"])
-                # subresource_domains = self._extract_domains(entry["subresource_under_origin"])
-
-                all_origins = set([entry["origin"]] + source_domains + destination_domains)
-
-                if self.indicators.check_domains(all_origins):
-                    self.detected.append(entry)
-
-                    redirect_path = ""
-                    if len(source_domains) > 0:
-                        redirect_path += "SOURCE: "
-                        for idx, item in enumerate(source_domains):
-                            source_domains[idx] = f"\"{item}\""
-
-                        redirect_path += ", ".join(source_domains)
-                        redirect_path += " -> "
-
-                    redirect_path += f"ORIGIN: \"{entry['origin']}\""
-
-                    if len(destination_domains) > 0:
-                        redirect_path += " -> "
-                        redirect_path += "DESTINATION: "
-                        for idx, item in enumerate(destination_domains):
-                            destination_domains[idx] = f"\"{item}\""
-
-                        redirect_path += ", ".join(destination_domains)
-
-                    self.log.warning("Found HTTP redirect between suspicious domains: %s", redirect_path)
-
-    def _extract_browsing_stats(self, log_path):
-        items = []
-
-        with open(log_path, "rb") as handle:
-            file_plist = plistlib.load(handle)
-
-        if "browsingStatistics" not in file_plist:
-            return items
-
-        browsing_stats = file_plist["browsingStatistics"]
-
-        for item in browsing_stats:
-            items.append({
-                "origin": item.get("PrevalentResourceOrigin", ""),
-                "redirect_source": item.get("topFrameUniqueRedirectsFrom", ""),
-                "redirect_destination": item.get("topFrameUniqueRedirectsTo", ""),
-                "subframe_under_origin": item.get("subframeUnderTopFrameOrigins", ""),
-                "subresource_under_origin": item.get("subresourceUnderTopFrameOrigins", ""),
-                "user_interaction": item.get("hadUserInteraction"),
-                "most_recent_interaction": convert_timestamp_to_iso(item["mostRecentUserInteraction"]),
-                "last_seen": convert_timestamp_to_iso(item["lastSeen"]),
-            })
-
-        return items
-
-    def run(self):
-        if self.is_backup:
-            for log_file in self._get_backup_files_from_manifest(relative_path=WEBKIT_SESSION_RESOURCE_LOG_BACKUP_RELPATH):
-                log_path = self._get_backup_file_from_id(log_file["file_id"])
-                if not log_path:
-                    continue
-                self.log.info("Found Safari browsing session resource log at path: %s", log_path)
-                self.results[log_path] = self._extract_browsing_stats(log_path)
-        elif self.is_fs_dump:
-            for log_path in self._get_fs_files_from_patterns(WEBKIT_SESSION_RESOURCE_LOG_ROOT_PATHS):
-                self.log.info("Found Safari browsing session resource log at path: %s", log_path)
-                key = os.path.relpath(log_path, self.base_folder)
-                self.results[key] = self._extract_browsing_stats(log_path)
-
-        self.log.info("Extracted records from %d Safari browsing session resource logs",
-                      len(self.results))

mvt/ios/modules/net_base.py

@@ -1,241 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import operator
-import sqlite3
-from pathlib import Path
-
-from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
-
-from .base import IOSExtraction
-
-
-class NetBase(IOSExtraction):
-    """This class provides a base for DataUsage and NetUsage extraction modules."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def _extract_net_data(self):
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                ZPROCESS.ZFIRSTTIMESTAMP,
-                ZPROCESS.ZTIMESTAMP,
-                ZPROCESS.ZPROCNAME,
-                ZPROCESS.ZBUNDLENAME,
-                ZPROCESS.Z_PK,
-                ZLIVEUSAGE.ZWIFIIN,
-                ZLIVEUSAGE.ZWIFIOUT,
-                ZLIVEUSAGE.ZWWANIN,
-                ZLIVEUSAGE.ZWWANOUT,
-                ZLIVEUSAGE.Z_PK,
-                ZLIVEUSAGE.ZHASPROCESS,
-                ZLIVEUSAGE.ZTIMESTAMP
-            FROM ZLIVEUSAGE
-            LEFT JOIN ZPROCESS ON ZLIVEUSAGE.ZHASPROCESS = ZPROCESS.Z_PK
-            UNION
-            SELECT ZFIRSTTIMESTAMP, ZTIMESTAMP, ZPROCNAME, ZBUNDLENAME, Z_PK, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM ZPROCESS WHERE Z_PK NOT IN (SELECT ZHASPROCESS FROM ZLIVEUSAGE);
-        """)
-
-        for row in cur:
-            # ZPROCESS records can be missing after the JOIN. Handle NULL timestamps.
-            if row[0] and row[1]:
-                first_isodate = convert_timestamp_to_iso(convert_mactime_to_unix(row[0]))
-                isodate = convert_timestamp_to_iso(convert_mactime_to_unix(row[1]))
-            else:
-                first_isodate = row[0]
-                isodate = row[1]
-
-            if row[11]:
-                live_timestamp = convert_timestamp_to_iso(convert_mactime_to_unix(row[11]))
-            else:
-                live_timestamp = ""
-
-            self.results.append({
-                "first_isodate": first_isodate,
-                "isodate": isodate,
-                "proc_name": row[2],
-                "bundle_id": row[3],
-                "proc_id": row[4],
-                "wifi_in": row[5],
-                "wifi_out": row[6],
-                "wwan_in": row[7],
-                "wwan_out": row[8],
-                "live_id": row[9],
-                "live_proc_id": row[10],
-                "live_isodate": live_timestamp if row[10] else first_isodate,
-            })
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted information on %d processes", len(self.results))
-
-    def serialize(self, record):
-        record_data = f"{record['proc_name']} (Bundle ID: {record['bundle_id']}, ID: {record['proc_id']})"
-        record_data_usage = record_data + f" WIFI IN: {record['wifi_in']}, WIFI OUT: {record['wifi_out']} - "  \
-            f"WWAN IN: {record['wwan_in']}, WWAN OUT: {record['wwan_out']}"
-
-        records = [{
-            "timestamp": record["live_isodate"],
-            "module": self.__class__.__name__,
-            "event": "live_usage",
-            "data": record_data_usage,
-        }]
-
-        # Only included first_usage and current_usage records when a ZPROCESS entry exists.
-        if "MANIPULATED" not in record["proc_name"] and "MISSING" not in record["proc_name"] and record["live_proc_id"] is not None:
-            records.extend([
-                {
-                    "timestamp": record["first_isodate"],
-                    "module": self.__class__.__name__,
-                    "event": "first_usage",
-                    "data": record_data,
-                },
-                {
-                    "timestamp": record["isodate"],
-                    "module": self.__class__.__name__,
-                    "event": "current_usage",
-                    "data": record_data,
-                }
-            ])
-
-        return records
-
-    def _find_suspicious_processes(self):
-        if not self.is_fs_dump:
-            return
-
-        if not self.results:
-            return
-
-        # If we are instructed to run fast, we skip this.
-        if self.fast_mode:
-            self.log.info("Flag --fast was enabled: skipping extended search for suspicious processes")
-            return
-
-        self.log.info("Extended search for suspicious processes ...")
-
-        files = []
-        for posix_path in Path(self.base_folder).rglob("*"):
-            try:
-                if not posix_path.is_file():
-                    continue
-            except PermissionError:
-                continue
-
-            files.append([posix_path.name, posix_path.__str__()])
-
-        for proc in self.results:
-            if not proc["bundle_id"]:
-                self.log.debug("Found process with no Bundle ID with name: %s", proc["proc_name"])
-
-                binary_path = None
-                for file in files:
-                    if proc["proc_name"] == file[0]:
-                        binary_path = file[1]
-                        break
-
-                if binary_path:
-                    self.log.debug("Located at %s", binary_path)
-                else:
-                    msg = f"Could not find the binary associated with the process with name {proc['proc_name']}"
-                    if (proc["proc_name"] is None):
-                        msg = f"Found process entry with empty 'proc_name' : {proc['live_proc_id']} at {proc['live_isodate']}"
-                    elif len(proc["proc_name"]) == 16:
-                        msg = msg + " (However, the process name might have been truncated in the database)"
-
-                    self.log.warning(msg)
-            if not proc["live_proc_id"]:
-                self.log.info(f"Found process entry in ZPROCESS but not in ZLIVEUSAGE : {proc['proc_name']} at {proc['live_isodate']}")
-
-    def check_manipulated(self):
-        """Check for missing or manipulate DB entries"""
-        # Don't show duplicates for each missing process.
-        missing_process_cache = set()
-        for result in sorted(self.results, key=operator.itemgetter("live_isodate")):
-            if result["proc_id"]:
-                continue
-
-            # Avoid duplicate warnings for same process.
-            if result["live_proc_id"] not in missing_process_cache:
-                missing_process_cache.add(result["live_proc_id"])
-                self.log.warning("Found manipulated process entry %s. Entry on %s",
-                                 result["live_proc_id"], result["live_isodate"])
-
-            # Set manipulated proc timestamp so it appears in timeline.
-            result["first_isodate"] = result["isodate"] = result["live_isodate"]
-            result["proc_name"] = "MANIPULATED [process record deleted]"
-            self.detected.append(result)
-
-    def find_deleted(self):
-        """Identify process which may have been deleted from the DataUsage database"""
-        results_by_proc = {proc["proc_id"]: proc for proc in self.results if proc["proc_id"]}
-        all_proc_id = sorted(results_by_proc.keys())
-
-        # Fix issue #108
-        if not all_proc_id:
-            return
-
-        missing_procs, last_proc_id = {}, None
-        for proc_id in range(min(all_proc_id), max(all_proc_id)):
-            if proc_id not in all_proc_id:
-                previous_proc = results_by_proc[last_proc_id]
-                self.log.info("Missing process %d. Previous process at \"%s\" (%s)",
-                              proc_id, previous_proc["first_isodate"], previous_proc["proc_name"])
-
-                missing_procs[proc_id] = {
-                    "proc_id": proc_id,
-                    "prev_proc_id": last_proc_id,
-                    "prev_proc_name": previous_proc["proc_name"],
-                    "prev_proc_bundle": previous_proc["bundle_id"],
-                    "prev_proc_first": previous_proc["first_isodate"],
-                }
-            else:
-                last_proc_id = proc_id
-
-        # Add a placeholder entry for the missing processes.
-        for proc_id, proc in missing_procs.items():
-            # Set default DataUsage keys.
-            result = {key: None for key in self.results[0].keys()}
-            result["first_isodate"] = result["isodate"] = result["live_isodate"] = proc["prev_proc_first"]
-            result["proc_name"] = "MISSING [follows {}]".format(proc["prev_proc_name"])
-            result["proc_id"] = result["live_proc_id"] = proc["proc_id"]
-            result["bundle_id"] = None
-
-            self.results.append(result)
-
-        self.results = sorted(self.results, key=operator.itemgetter("first_isodate"))
-
-    def check_indicators(self):
-        # Check for manipulated process records.
-        # TODO: Catching KeyError for live_isodate for retro-compatibility.
-        #       This is not very good.
-        try:
-            self.check_manipulated()
-            self.find_deleted()
-        except KeyError:
-            pass
-
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            try:
-                proc_name = result["proc_name"]
-            except KeyError:
-                continue
-
-            # Process ID may be empty if process records have been manipulated.
-            if not result["proc_id"]:
-                continue
-
-            if self.indicators.check_process(proc_name):
-                self.detected.append(result)

mvt/ios/versions.py

@@ -1,252 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-IPHONE_MODELS = [
-    {"identifier": "iPhone4,1", "description": "iPhone 4S"},
-    {"identifier": "iPhone5,1", "description": "iPhone 5"},
-    {"identifier": "iPhone5,2", "description": "iPhone 5"},
-    {"identifier": "iPhone5,3", "description": "iPhone 5c"},
-    {"identifier": "iPhone5,4", "description": "iPhone 5c"},
-    {"identifier": "iPhone6,1", "description": "iPhone 5s"},
-    {"identifier": "iPhone6,2", "description": "iPhone 5s"},
-    {"identifier": "iPhone7,1", "description": "iPhone 6 Plus"},
-    {"identifier": "iPhone7,2", "description": "iPhone 6"},
-    {"identifier": "iPhone8,1", "description": "iPhone 6s"},
-    {"identifier": "iPhone8,2", "description": "iPhone 6s Plus"},
-    {"identifier": "iPhone8,4", "description": "iPhone SE (1st generation)"},
-    {"identifier": "iPhone9,1", "description": "iPhone 7"},
-    {"identifier": "iPhone9,2", "description": "iPhone 7 Plus"},
-    {"identifier": "iPhone9,3", "description": "iPhone 7"},
-    {"identifier": "iPhone9,4", "description": "iPhone 7 Plus"},
-    {"identifier": "iPhone10,1", "description": "iPhone 8"},
-    {"identifier": "iPhone10,2", "description": "iPhone 8 Plus"},
-    {"identifier": "iPhone10,3", "description": "iPhone X"},
-    {"identifier": "iPhone10,4", "description": "iPhone 8"},
-    {"identifier": "iPhone10,5", "description": "iPhone 8 Plus"},
-    {"identifier": "iPhone10,6", "description": "iPhone X"},
-    {"identifier": "iPhone11,2", "description": "iPhone XS"},
-    {"identifier": "iPhone11,4", "description": "iPhone XS Max"},
-    {"identifier": "iPhone11,6", "description": "iPhone XS Max"},
-    {"identifier": "iPhone11,8", "description": "iPhone XR"},
-    {"identifier": "iPhone12,1", "description": "iPhone 11"},
-    {"identifier": "iPhone12,3", "description": "iPhone 11 Pro"},
-    {"identifier": "iPhone12,5", "description": "iPhone 11 Pro Max"},
-    {"identifier": "iPhone12,8", "description": "iPhone SE (2nd generation)"},
-    {"identifier": "iPhone13,1", "description": "iPhone 12 mini"},
-    {"identifier": "iPhone13,2", "description": "iPhone 12"},
-    {"identifier": "iPhone13,3", "description": "iPhone 12 Pro"},
-    {"identifier": "iPhone13,4", "description": "iPhone 12 Pro Max"},
-    {"identifier": "iPhone14,4", "description": "iPhone 13 Mini"},
-    {"identifier": "iPhone14,5", "description": "iPhone 13"},
-    {"identifier": "iPhone14,2", "description": "iPhone 13 Pro"},
-    {"identifier": "iPhone14,3", "description": "iPhone 13 Pro Max"},
-]
-
-IPHONE_IOS_VERSIONS = [
-    {"build": "1A543a", "version": "1.0"},
-    {"build": "1C25", "version": "1.0.1"},
-    {"build": "1C28", "version": "1.0.2"},
-    {"build": "3A109a", "version": "1.1.1"},
-    {"build": "3B48b", "version": "1.1.2"},
-    {"build": "4A93", "version": "1.1.3"},
-    {"build": "4A102", "version": "1.1.4"},
-    {"build": "5A347", "version": "2.0"},
-    {"build": "5B108", "version": "2.0.1"},
-    {"build": "5C1", "version": "2.0.2"},
-    {"build": "5F136", "version": "2.1"},
-    {"build": "5G77", "version": "2.2"},
-    {"build": "5H11", "version": "2.2.1"},
-    {"build": "7A341", "version": "3.0"},
-    {"build": "7A400", "version": "3.0.1"},
-    {"build": "7C144", "version": "3.1"},
-    {"build": "7D11", "version": "3.1.2"},
-    {"build": "7E18", "version": "3.1.3"},
-    {"build": "8A293", "version": "4.0"},
-    {"build": "8A306", "version": "4.0.1"},
-    {"build": "8B117", "version": "4.1"},
-    {"build": "8C148", "version": "4.2"},
-    {"build": "8C148a", "version": "4.2.1"},
-    {"build": "8C148", "version": "4.2.1"},
-    {"build": "8E600", "version": "4.2.10"},
-    {"build": "8E401", "version": "4.2.8"},
-    {"build": "8E501", "version": "4.2.9"},
-    {"build": "8F190", "version": "4.3"},
-    {"build": "8J2", "version": "4.3.3"},
-    {"build": "8K2", "version": "4.3.4"},
-    {"build": "8L1", "version": "4.3.5"},
-    {"build": "9A334", "version": "5.0"},
-    {"build": "9A405", "version": "5.0.1"},
-    {"build": "9A406", "version": "5.0.1"},
-    {"build": "9B176", "version": "5.1"},
-    {"build": "9B179", "version": "5.1"},
-    {"build": "9B206", "version": "5.1.1"},
-    {"build": "9B208", "version": "5.1.1"},
-    {"build": "10A403", "version": "6.0"},
-    {"build": "10A405", "version": "6.0"},
-    {"build": "10A523", "version": "6.0.1"},
-    {"build": "10A525", "version": "6.0.1"},
-    {"build": "10A551", "version": "6.0.2"},
-    {"build": "10B141", "version": "6.1"},
-    {"build": "10B144", "version": "6.1"},
-    {"build": "10B142", "version": "6.1"},
-    {"build": "10B143", "version": "6.1"},
-    {"build": "10B145", "version": "6.1.1"},
-    {"build": "10B146", "version": "6.1.2"},
-    {"build": "10B329", "version": "6.1.3"},
-    {"build": "10B350", "version": "6.1.4"},
-    {"build": "10B500", "version": "6.1.6"},
-    {"build": "11B511", "version": "7.0.3"},
-    {"build": "11B554a", "version": "7.0.4"},
-    {"build": "11B601", "version": "7.0.5"},
-    {"build": "11B651", "version": "7.0.6"},
-    {"build": "11D169", "version": "7.1"},
-    {"build": "11D167", "version": "7.1"},
-    {"build": "11D201", "version": "7.1.1"},
-    {"build": "11D257", "version": "7.1.2"},
-    {"build": "12A365", "version": "8.0"},
-    {"build": "12A366", "version": "8.0"},
-    {"build": "12A402", "version": "8.0.1"},
-    {"build": "12A405", "version": "8.0.2"},
-    {"build": "12B411", "version": "8.1"},
-    {"build": "12B435", "version": "8.1.1"},
-    {"build": "12B436", "version": "8.1.1"},
-    {"build": "12B440", "version": "8.1.2"},
-    {"build": "12B466", "version": "8.1.3"},
-    {"build": "12D508", "version": "8.2"},
-    {"build": "12F70", "version": "8.3"},
-    {"build": "12H143", "version": "8.4"},
-    {"build": "12H321", "version": "8.4.1"},
-    {"build": "13A344", "version": "9.0"},
-    {"build": "13A342", "version": "9.0"},
-    {"build": "13A343", "version": "9.0"},
-    {"build": "13A404", "version": "9.0.1"},
-    {"build": "13A405", "version": "9.0.1"},
-    {"build": "13A452", "version": "9.0.2"},
-    {"build": "13B143", "version": "9.1"},
-    {"build": "13C75", "version": "9.2"},
-    {"build": "13D15", "version": "9.2.1"},
-    {"build": "13D20", "version": "9.2.1"},
-    {"build": "13E237", "version": "9.3"},
-    {"build": "13E233", "version": "9.3"},
-    {"build": "13E234", "version": "9.3"},
-    {"build": "13E238", "version": "9.3.1"},
-    {"build": "13F69", "version": "9.3.2"},
-    {"build": "13G34", "version": "9.3.3"},
-    {"build": "13G35", "version": "9.3.4"},
-    {"build": "13G36", "version": "9.3.5"},
-    {"build": "13G37", "version": "9.3.6"},
-    {"build": "14A403", "version": "10.0.1"},
-    {"build": "14A456", "version": "10.0.2"},
-    {"build": "14A551", "version": "10.0.3"},
-    {"build": "14B72", "version": "10.1"},
-    {"build": "14B72c", "version": "10.1"},
-    {"build": "14B150", "version": "10.1.1"},
-    {"build": "14B100", "version": "10.1.1"},
-    {"build": "14C92", "version": "10.2"},
-    {"build": "14D27", "version": "10.2.1"},
-    {"build": "14E277", "version": "10.3"},
-    {"build": "14E304", "version": "10.3.1"},
-    {"build": "14F89", "version": "10.3.2"},
-    {"build": "14G60", "version": "10.3.3"},
-    {"build": "14G61", "version": "10.3.4"},
-    {"build": "15A372", "version": "11.0"},
-    {"build": "15A402", "version": "11.0.1"},
-    {"build": "15A421", "version": "11.0.2"},
-    {"build": "15A432", "version": "11.0.3"},
-    {"build": "15B93", "version": "11.1"},
-    {"build": "15B150", "version": "11.1.1"},
-    {"build": "15B202", "version": "11.1.2"},
-    {"build": "15C114", "version": "11.2"},
-    {"build": "15C153", "version": "11.2.1"},
-    {"build": "15C202", "version": "11.2.2"},
-    {"build": "15D60", "version": "11.2.5"},
-    {"build": "15D100", "version": "11.2.6"},
-    {"build": "15E216", "version": "11.3"},
-    {"build": "15E302", "version": "11.3.1"},
-    {"build": "15F79", "version": "11.4"},
-    {"build": "15G77", "version": "11.4.1"},
-    {"build": "16A366", "version": "12.0"},
-    {"build": "16A404", "version": "12.0.1"},
-    {"build": "16A405", "version": "12.0.1"},
-    {"build": "16B92", "version": "12.1"},
-    {"build": "16B94", "version": "12.1"},
-    {"build": "16B93", "version": "12.1"},
-    {"build": "16C50", "version": "12.1.1"},
-    {"build": "16C104", "version": "12.1.2"},
-    {"build": "16C101", "version": "12.1.2"},
-    {"build": "16D39", "version": "12.1.3"},
-    {"build": "16D40", "version": "12.1.3"},
-    {"build": "16D57", "version": "12.1.4"},
-    {"build": "16E227", "version": "12.2"},
-    {"build": "16F156", "version": "12.3"},
-    {"build": "16F203", "version": "12.3.1"},
-    {"build": "16F250", "version": "12.3.2"},
-    {"build": "16G77", "version": "12.4"},
-    {"build": "16G102", "version": "12.4.1"},
-    {"build": "16G114", "version": "12.4.2"},
-    {"build": "16G130", "version": "12.4.3"},
-    {"build": "16G161", "version": "12.4.5"},
-    {"build": "16G183", "version": "12.4.6"},
-    {"build": "16G192", "version": "12.4.7"},
-    {"build": "16G201", "version": "12.4.8"},
-    {"build": "16H5", "version": "12.4.9"},
-    {"build": "16H20", "version": "12.5"},
-    {"build": "16H22", "version": "12.5.1"},
-    {"build": "17A577", "version": "13.0"},
-    {"build": "17A844", "version": "13.1"},
-    {"build": "17A854", "version": "13.1.1"},
-    {"build": "17A860", "version": "13.1.2"},
-    {"build": "17A861", "version": "13.1.2"},
-    {"build": "17A878", "version": "13.1.3"},
-    {"build": "17B84", "version": "13.2"},
-    {"build": "17B102", "version": "13.2.2"},
-    {"build": "17B111", "version": "13.2.3"},
-    {"build": "17C54", "version": "13.3"},
-    {"build": "17D50", "version": "13.3.1"},
-    {"build": "17E255", "version": "13.4"},
-    {"build": "17E262", "version": "13.4.1"},
-    {"build": "17E8258", "version": "13.4.1"},
-    {"build": "17F75", "version": "13.5"},
-    {"build": "17F80", "version": "13.5.1"},
-    {"build": "17G68", "version": "13.6"},
-    {"build": "17G80", "version": "13.6.1"},
-    {"build": "17H35", "version": "13.7"},
-    {"build": "18A373", "version": "14.0"},
-    {"build": "18A393", "version": "14.0.1"},
-    {"build": "18A8395", "version": "14.1"},
-    {"build": "18B92", "version": "14.2"},
-    {"build": "18C66", "version": "14.3"},
-    {"build": "18D52", "version": "14.4"},
-    {"build": "18D61", "version": "14.4.1"},
-    {"build": "18D70", "version": "14.4.2"},
-    {"build": "18E199", "version": "14.5"},
-    {"build": "18E212", "version": "14.5.1"},
-    {"build": "18F72", "version": "14.6"},
-    {"build": "18G69", "version": "14.7"},
-    {"build": "18G82", "version": "14.7.1"},
-    {"build": "18H17", "version": "14.8"},
-    {"build": "18H107", "version": "14.8.1"},
-    {"build": "19A341", "version": "15.0"},
-    {"build": "19A346", "version": "15.0"},
-    {"build": "19A348", "version": "15.0.1"},
-    {"build": "19A404", "version": "15.0.2"},
-    {"build": "19B74", "version": "15.1"},
-    {"build": "19B81", "version": "15.1.1"},
-    {"build": "19C56", "version": "15.2"},
-    {"build": "19C63", "version": "15.2.1"},
-]
-
-
-def get_device_desc_from_id(identifier, devices_list=IPHONE_MODELS):
-    for model in IPHONE_MODELS:
-        if identifier == model["identifier"]:
-            return model["description"]
-
-
-def find_version_by_build(build):
-    build = build.upper()
-    for version in IPHONE_IOS_VERSIONS:
-        if build == version["build"]:
-            return version["version"]

public_indicators.json

@@ -1,14 +0,0 @@
-[
-    {
-        "name": "NSO Group Pegasus Indicators of Compromise",
-        "source": "Amnesty International",
-        "reference": "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
-        "stix2_url": "https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-07-18_nso/pegasus.stix2"
-    },
-    {
-        "name": "Cytrox Predator Spyware Indicators of Compromise",
-        "source": "Meta, Amnesty International, Citizen Lab",
-        "reference": "https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/",
-        "stix2_url": "https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-12-16_cytrox/cytrox.stix2"
-    }
-]

pyproject.toml

@@ -0,0 +1,106 @@
+[project]
+name = "mvt"
+dynamic = ["version"]
+authors = [
+    {name = "Claudio Guarnieri", email = "nex@nex.sx"}
+]
+maintainers = [
+    {name = "Etienne Maynier", email = "tek@randhome.io"},
+    {name = "Donncha Ó Cearbhaill", email = "donncha.ocearbhaill@amnesty.org"},
+    {name = "Rory Flynn", email = "rory.flynn@amnesty.org"}
+]
+description = "Mobile Verification Toolkit"
+readme = "README.md"
+keywords = ["security", "mobile", "forensics", "malware"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Information Technology",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python"
+]
+dependencies = [
+    "click >=8.1.3",
+    "rich >=12.6.0",
+    "tld >=0.12.6",
+    "requests >=2.28.1",
+    "simplejson >=3.17.6",
+    "packaging >=21.3",
+    "appdirs >=1.4.4",
+    "iOSbackup >=0.9.923",
+    "adb-shell[usb] >=0.4.3",
+    "libusb1 >=3.0.0",
+    "cryptography >=42.0.5",
+    "pyyaml >=6.0",
+    "pyahocorasick >= 2.0.0",
+    "betterproto >=1.2.0",
+    "pydantic >= 2.10.0",
+    "pydantic-settings >= 2.7.0",
+    'backports.zoneinfo; python_version < "3.9"',
+]
+requires-python = ">= 3.8"
+
+[project.urls]
+homepage = "https://docs.mvt.re/en/latest/"
+repository = "https://github.com/mvt-project/mvt"
+
+[project.scripts]
+    mvt-ios = "mvt.ios:cli"
+    mvt-android = "mvt.android:cli"
+
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[tool.coverage.run]
+omit = [
+    "tests/*",
+]
+
+[tool.coverage.html]
+directory= "htmlcov"
+
+[tool.mypy]
+install_types = true
+non_interactive = true
+ignore_missing_imports = true
+packages = "src"
+
+[tool.pytest.ini_options]
+addopts = "-ra -q --cov=mvt --cov-report html --junitxml=pytest.xml --cov-report=term-missing:skip-covered"
+testpaths = [
+    "tests"
+]
+
+[tool.ruff.lint]
+select = ["C90", "E", "F", "W"]  # flake8 default set
+ignore = [
+    "E501",  # don't enforce line length violations
+    "C901",  # complex-structure
+
+    # These were previously ignored but don't seem to be required:
+    # "E265",  # no-space-after-block-comment
+    # "F401",  # unused-import
+    # "E127",  # not included in ruff
+    # "W503",  # not included in ruff
+    # "E226",  # missing-whitespace-around-arithmetic-operator
+    # "E203",  # whitespace-before-punctuation
+]
+
+[tool.ruff.lint.per-file-ignores]
+"__init__.py" = ["F401"]  # unused-import
+
+[tool.ruff.lint.mccabe]
+max-complexity = 10
+
+[tool.setuptools]
+include-package-data = true
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+mvt = ["ios/data/*.json"]
+
+[tool.setuptools.dynamic]
+version = {attr = "mvt.common.version.MVT_VERSION"}

setup.py

@@ -1,68 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-
-from setuptools import find_packages, setup
-
-from mvt.common.version import MVT_VERSION
-
-this_directory = os.path.abspath(os.path.dirname(__file__))
-readme_path = os.path.join(this_directory, "README.md")
-with open(readme_path, encoding="utf-8") as handle:
-    long_description = handle.read()
-
-requires = (
-    # Base dependencies:
-    "click>=8.0.3",
-    "rich>=10.12.0",
-    "tld>=0.12.6",
-    "tqdm>=4.62.3",
-    "requests>=2.26.0",
-    "simplejson>=3.17.5",
-    "packaging>=21.0",
-    "appdirs>=1.4.4",
-    # iOS dependencies:
-    "iOSbackup>=0.9.921",
-    # Android dependencies:
-    "adb-shell>=0.4.2",
-    "libusb1>=2.0.1",
-)
-
-
-def get_package_data(package):
-    walk = [(dirpath.replace(package + os.sep, "", 1), filenames)
-            for dirpath, dirnames, filenames in os.walk(package)
-            if not os.path.exists(os.path.join(dirpath, "__init__.py"))]
-
-    filepaths = []
-    for base, filenames in walk:
-        filepaths.extend([os.path.join(base, filename)
-                          for filename in filenames])
-    return {package: filepaths}
-
-
-setup(
-    name="mvt",
-    version=MVT_VERSION,
-    description="Mobile Verification Toolkit",
-    long_description=long_description,
-    long_description_content_type="text/markdown",
-    url="https://github.com/mvt-project/mvt",
-    entry_points={
-        "console_scripts": [
-            "mvt-ios = mvt.ios:cli",
-            "mvt-android = mvt.android:cli",
-        ],
-    },
-    install_requires=requires,
-    packages=find_packages(),
-    package_data=get_package_data("mvt"),
-    include_package_data=True,
-    keywords="security mobile forensics malware",
-    license="MVT",
-    classifiers=[
-    ],
-)

src/mvt/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

src/mvt/android/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/